Description

XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter.

Remediation

References

http://struts.apache.org/docs/s2-031.html

http://www.securityfocus.com/bid/88826

http://www.securitytracker.com/id/1035664

Related Vulnerabilities

CVE-2022-34916 Vulnerability in maven package org.apache.flume.flume-ng-sources:flume-jms-source

CVE-2020-26939 Vulnerability in maven package org.bouncycastle:bcprov-ext-jdk15to18

CVE-2016-0789 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2023-31579 Vulnerability in maven package top.tangyh.basic:lamp-util

CVE-2023-34234 Vulnerability in npm package @openzeppelin/contracts

Severity

Critical

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Vendor Advisory CWE-20