{"id":"CVE-2016-4436","published":"2016-10-03T15:00:00Z","modified":"2024-08-06T00:32:24Z","title":"Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to…","vendor":null,"product":null,"tier":"tail","description":{"text":"Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.06603,"percentile":0.93823,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/bid/91280","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21987854","tags":["x_refsource_CONFIRM"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=ssg1S1009282","tags":["x_refsource_CONFIRM"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","tags":["x_refsource_CONFIRM"]},{"url":"https://struts.apache.org/docs/s2-035.html","tags":["x_refsource_CONFIRM"]}],"priority":{"score":18.8,"factors":[{"name":"EPSS percentile","points":18.76}]},"affected":[{"ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.0.0, <2.3.29",">=2.5-BETA1, <2.5.1"],"patched":["2.3.29","2.5.1"],"from":["GHSA-xm92-v2mq-842q"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5822","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2016-3087","published":"2016-06-07","fixed":"2.3.28.1","kev":false},{"cve":"CVE-2016-4438","published":"2016-07-04","fixed":"2.3.29","kev":false},{"cve":"CVE-2016-4461","published":"2017-10-16","fixed":"2.3.29","kev":false},{"cve":"CVE-2016-4436","published":"2016-10-03","fixed":"2.5.1","kev":false},{"cve":"CVE-2017-5638","published":"2017-03-11","fixed":"2.5.10.1","kev":true,"link":{"from":"CVE-2016-4436","to":"CVE-2017-5638","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts:struts2-core","fromFixed":"2.5.1","toFixed":"2.5.10.1","daysApart":159}]}},{"cve":"CVE-2017-12611","published":"2017-09-20","fixed":"2.5.11","kev":false},{"cve":"CVE-2017-7672","published":"2017-07-13","fixed":"2.5.12","kev":false}],"package":"Maven:org.apache.struts:struts2-core"}}