Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
HTTP:APACHE:STRUTS-XSLT-FI |
|---|---|
Severity |
Major |
Recommended |
Yes |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Apache Struts XSLTResult File Inclusion |
Release Date |
2016/05/17 |
Update Number |
2723 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
HTTP: Apache Struts XSLTResult File Inclusion
This signature detects attempts to exploit a known vulnerability against Apache's Struts 2 web application framework. A successful attack attempt could result in the execution of arbitrary code.
Extended Description
XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter.
Affected Products
- Apache struts 2.0.0
- Apache struts 2.0.1
- Apache struts 2.0.10
- Apache struts 2.0.11
- Apache struts 2.0.11.1
- Apache struts 2.0.11.2
- Apache struts 2.0.12
- Apache struts 2.0.13
- Apache struts 2.0.14
- Apache struts 2.0.2
- Apache struts 2.0.3
- Apache struts 2.0.4
- Apache struts 2.0.5
- Apache struts 2.0.6
- Apache struts 2.0.7
- Apache struts 2.0.8
- Apache struts 2.0.9
- Apache struts 2.1.0
- Apache struts 2.1.1
- Apache struts 2.1.2
- Apache struts 2.1.3
- Apache struts 2.1.4
- Apache struts 2.1.5
- Apache struts 2.1.6
- Apache struts 2.1.8
- Apache struts 2.1.8.1
- Apache struts 2.2.1
- Apache struts 2.2.1.1
- Apache struts 2.2.3
- Apache struts 2.2.3.1
- Apache struts 2.3.1
- Apache struts 2.3.1.1
- Apache struts 2.3.12
- Apache struts 2.3.1.2
- Apache struts 2.3.14
- Apache struts 2.3.14.1
- Apache struts 2.3.14.2
- Apache struts 2.3.14.3
- Apache struts 2.3.15
- Apache struts 2.3.15.1
- Apache struts 2.3.15.2
- Apache struts 2.3.15.3
- Apache struts 2.3.16
- Apache struts 2.3.16.1
- Apache struts 2.3.16.2
- Apache struts 2.3.16.3
- Apache struts 2.3.20
- Apache struts 2.3.20.1
- Apache struts 2.3.24
- Apache struts 2.3.24.1
- Apache struts 2.3.28
- Apache struts 2.3.3
- Apache struts 2.3.4
- Apache struts 2.3.4.1
- Apache struts 2.3.7
- Apache struts 2.3.8
References
- CVE: CVE-2016-3082