ID CVE-2016-4436
Summary Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up.
References
Vulnerable Configurations
  • Apache Software Foundation Struts 2.3.20
    cpe:2.3:a:apache:struts:2.3.20
  • Apache Software Foundation Struts 2.3.16.3
    cpe:2.3:a:apache:struts:2.3.16.3
  • Apache Software Foundation Struts 2.3.16.2
    cpe:2.3:a:apache:struts:2.3.16.2
  • Apache Software Foundation Struts 2.3.16.1
    cpe:2.3:a:apache:struts:2.3.16.1
  • Apache Software Foundation Struts 2.3.16
    cpe:2.3:a:apache:struts:2.3.16
  • Apache Software Foundation Struts 2.3.15.3
    cpe:2.3:a:apache:struts:2.3.15.3
  • Apache Software Foundation Struts 2.3.15.2
    cpe:2.3:a:apache:struts:2.3.15.2
  • Apache Software Foundation Struts 2.3.15
    cpe:2.3:a:apache:struts:2.3.15
  • Apache Software Foundation Struts 2.3.15.1
    cpe:2.3:a:apache:struts:2.3.15.1
  • Apache Software Foundation Struts 2.3.14.3
    cpe:2.3:a:apache:struts:2.3.14.3
  • Apache Software Foundation Struts 2.3.14.2
    cpe:2.3:a:apache:struts:2.3.14.2
  • Apache Software Foundation Struts 2.3.14.1
    cpe:2.3:a:apache:struts:2.3.14.1
  • Apache Software Foundation Struts 2.3.14
    cpe:2.3:a:apache:struts:2.3.14
  • Apache Software Foundation Struts 2.3.12
    cpe:2.3:a:apache:struts:2.3.12
  • Apache Software Foundation Struts 2.3.7
    cpe:2.3:a:apache:struts:2.3.7
  • Apache Software Foundation Struts 2.3.8
    cpe:2.3:a:apache:struts:2.3.8
  • Apache Software Foundation Struts 2.3.4.1
    cpe:2.3:a:apache:struts:2.3.4.1
  • Apache Software Foundation Struts 2.3.3
    cpe:2.3:a:apache:struts:2.3.3
  • Apache Software Foundation Struts 2.3.4
    cpe:2.3:a:apache:struts:2.3.4
  • Apache Software Foundation Struts 2.3.1.2
    cpe:2.3:a:apache:struts:2.3.1.2
  • Apache Software Foundation Struts 2.3.1.1
    cpe:2.3:a:apache:struts:2.3.1.1
  • Apache Software Foundation Struts 2.3.1
    cpe:2.3:a:apache:struts:2.3.1
  • Apache Software Foundation Struts 2.2.3.1
    cpe:2.3:a:apache:struts:2.2.3.1
  • Apache Software Foundation Struts 2.2.3
    cpe:2.3:a:apache:struts:2.2.3
  • Apache Software Foundation Struts 2.2.1.1
    cpe:2.3:a:apache:struts:2.2.1.1
  • Apache Software Foundation Struts 2.2.1
    cpe:2.3:a:apache:struts:2.2.1
  • Apache Software Foundation Struts 2.1.8.1
    cpe:2.3:a:apache:struts:2.1.8.1
  • Apache Software Foundation Struts 2.1.8
    cpe:2.3:a:apache:struts:2.1.8
  • Apache Software Foundation Struts 2.1.6
    cpe:2.3:a:apache:struts:2.1.6
  • Apache Software Foundation Struts 2.0.14
    cpe:2.3:a:apache:struts:2.0.14
  • Apache Software Foundation Struts 2.0.12
    cpe:2.3:a:apache:struts:2.0.12
  • Apache Software Foundation Struts 2.0.11.2
    cpe:2.3:a:apache:struts:2.0.11.2
  • Apache Software Foundation Struts 2.0.11.1
    cpe:2.3:a:apache:struts:2.0.11.1
  • Apache Software Foundation Struts 2.0.0
    cpe:2.3:a:apache:struts:2.0.0
  • Apache Software Foundation Struts 2.0.1
    cpe:2.3:a:apache:struts:2.0.1
  • Apache Software Foundation Struts 2.0.2
    cpe:2.3:a:apache:struts:2.0.2
  • Apache Software Foundation Struts 2.0.3
    cpe:2.3:a:apache:struts:2.0.3
  • Apache Software Foundation Struts 2.0.4
    cpe:2.3:a:apache:struts:2.0.4
  • Apache Software Foundation Struts 2.0.5
    cpe:2.3:a:apache:struts:2.0.5
  • Apache Software Foundation Struts 2.0.6
    cpe:2.3:a:apache:struts:2.0.6
  • Apache Software Foundation Struts 2.0.7
    cpe:2.3:a:apache:struts:2.0.7
  • Apache Software Foundation Struts 2.0.8
    cpe:2.3:a:apache:struts:2.0.8
  • Apache Software Foundation Struts 2.0.9
    cpe:2.3:a:apache:struts:2.0.9
  • Apache Software Foundation Struts 2.0.11
    cpe:2.3:a:apache:struts:2.0.11
  • Apache Software Foundation Struts 2.3.20.1
    cpe:2.3:a:apache:struts:2.3.20.1
  • Apache Software Foundation Struts 2.3.20.3
    cpe:2.3:a:apache:struts:2.3.20.3
  • Apache Software Foundation Struts 2.3.24
    cpe:2.3:a:apache:struts:2.3.24
  • cpe:2.3:a:apache:struts:2.3.24.1
    cpe:2.3:a:apache:struts:2.3.24.1
  • Apache Struts 2.3.24.3
    cpe:2.3:a:apache:struts:2.3.24.3
  • Apache Software Foundation Struts 2.3.28
    cpe:2.3:a:apache:struts:2.3.28
  • Apache Struts 2.3.28.1
    cpe:2.3:a:apache:struts:2.3.28.1
  • Apache Struts 2.5
    cpe:2.3:a:apache:struts:2.5
  • Apache Struts 2.5 Beta 1
    cpe:2.3:a:apache:struts:2.5:beta1
  • Apache Struts 2.5 Beta 2
    cpe:2.3:a:apache:struts:2.5:beta2
  • Apache Struts 2.5 Beta 3
    cpe:2.3:a:apache:struts:2.5:beta3
CVSS
Base: 7.5 (as of 21-10-2016 - 10:28)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family Misc.
    NASL id STRUTS_2_3_29_WIN_LOCAL.NASL
    description The version of Apache Struts running on the remote Windows host is 2.x prior to 2.3.29. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability exists due to erroneously performing double OGNL evaluation of attribute values assigned to certain tags. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary code. (CVE-2016-0785) - A cross-site request forgery (XSRF) vulnerability exists due to improper validation of session tokens. An unauthenticated, remote attacker can exploit this, via a malicious OGNL expression, to bypass token validation and perform an XSRF attack. (CVE-2016-4430) - Multiple input validation issues exists that allow internal security mechanisms to be bypassed, allowing the manipulation of a return string which can be used to redirect users to a malicious website. This affects both the default action method the 'getter' action method. (CVE-2016-4431, CVE-2016-4433) - An unspecified flaw exists that is triggered during the cleanup of action names. An unauthenticated, remote attacker can exploit this, via a specially crafted payload, to perform unspecified actions. (CVE-2016-4436) - A remote code execution vulnerability exists in the REST plugin due to improper handling of OGNL expressions. An unauthenticated, remote attacker can exploit this, via a specially crafted OGNL expression, to execute arbitrary code. (CVE-2016-4438) - A denial of service vulnerability exists in URLValidator due to improper handling of form fields. An unauthenticated, remote attacker can exploit this, via a crafted URL, to overload the server when performing validation on the URL. (CVE-2016-4465) - A remote code execution vulnerability exists in user tag attributes due to improper handling of OGNL expressions. An unauthenticated, remote attacker can exploit this, via a specially crafted double OGNL evaluation, to execute arbitrary code. (CVE-2016-4461) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-02-23
    modified 2019-02-22
    plugin id 91812
    published 2016-06-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=91812
    title Apache Struts 2.x < 2.3.29 Multiple Vulnerabilities (S2-035 - S2-041)
  • NASL family CGI abuses
    NASL id MYSQL_ENTERPRISE_MONITOR_3_3_3_1199.NASL
    description According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 3.1.x prior to 3.1.7.8023, 3.2.x prior to 3.2.7.1204, or 3.3.x prior to 3.3.3.1199. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists in the Apache Commons component in the FileUpload functionality due to improper handling of file upload requests. An unauthenticated, remote attacker can exploit this, via a specially crafted content-type header, to cause a denial of service condition. Note that this vulnerability does not affect MySQL Enterprise Monitor versions 3.3.x. (CVE-2016-3092) - An unspecified flaw exists in the Apache Struts component that is triggered during the cleanup of action names. An unauthenticated, remote attacker can exploit this, via a specially crafted payload, to perform unspecified actions. (CVE-2016-4436) - A carry propagation error exists in the OpenSSL component in the Broadwell-specific Montgomery multiplication procedure when handling input lengths divisible by but longer than 256 bits. This can result in transient authentication and key negotiation failures or reproducible erroneous outcomes of public-key operations with specially crafted input. A man-in-the-middle attacker can possibly exploit this issue to compromise ECDH key negotiations that utilize Brainpool P-512 curves. (CVE-2016-7055) - An unspecified flaw exists in the Monitoring Server subcomponent that allows an authenticated, remote attacker to impact confidentiality and integrity. (CVE-2017-3306) - An unspecified flaw exists in the Monitoring Server subcomponent that allows an authenticated, remote attacker to impact integrity and availability. (CVE-2017-3307) - An out-of-bounds read error exists in the OpenSSL component when handling packets using the CHACHA20/POLY1305 or RC4-MD5 ciphers. An unauthenticated, remote attacker can exploit this, via specially crafted truncated packets, to cause a denial of service condition. (CVE-2017-3731) - A carry propagating error exists in the OpenSSL component in the x86_64 Montgomery squaring implementation that may cause the BN_mod_exp() function to produce incorrect results. An unauthenticated, remote attacker with sufficient resources can exploit this to obtain sensitive information regarding private keys. (CVE-2017-3732) - A remote code execution vulnerability exists in the Apache Struts component in the Jakarta Multipart parser due to improper handling of the Content-Type, Content-Disposition, and Content-Length headers. An unauthenticated, remote attacker can exploit this, via a specially crafted header value in the HTTP request, to execute arbitrary code. (CVE-2017-5638)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 99593
    published 2017-04-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99593
    title MySQL Enterprise Monitor 3.1.x < 3.1.7.8023 / 3.2.x < 3.2.7.1204 / 3.3.x < 3.3.3.1199 Multiple Vulnerabilities (April 2017 CPU)
refmap via4
bid 91280
confirm
Last major update 21-10-2016 - 10:35
Published 03-10-2016 - 11:59
Last modified 08-08-2017 - 21:29
Back to Top