CVE-2016-3090

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression with ANTLR tooling.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/85131Third Party Advisory, VDB Entry
https://security.netapp.com/advisory/ntap-20180629-0005/
https://struts.apache.org/docs/s2-027.htmlVendor Advisory
https://www.securitytracker.com/id/1035267Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/85131Third Party Advisory, VDB Entry
https://security.netapp.com/advisory/ntap-20180629-0005/
https://struts.apache.org/docs/s2-027.htmlVendor Advisory
https://www.securitytracker.com/id/1035267Third Party Advisory, VDB Entry

Timeline

Published: Oct 30, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-30917.5Cloud Foundry Diego 0.1468.0 through 0.1470.0 allows remote attackers to cause a denial of service.CVE-2016-30927.5The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x be CVE-2016-30935.3Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attack CVE-2016-30945.9PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers t CVE-2016-30955.5server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key.CVE-2016-30967.8The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbit CVE-2016-30976.1Cross-site scripting (XSS) vulnerability in spacewalk-java in Red Hat Satellite 5.7 allows remote attackers to inject arbitrary web script o CVE-2016-30985.4Cross-site request forgery (CSRF) vulnerability in administrate 0.1.4 and earlier allows remote attackers to hijack the user's OAuth autoriz CVE-2016-30997.5mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise CVE-2016-31008.4kinit in KDE Frameworks before 5.23.0 uses weak permissions (644) for /tmp/xauth-xxx-_y, which allows local users to obtain X11 cookies of o CVE-2016-31015.4Cross-site scripting (XSS) vulnerability in the Extra Columns plugin before 1.17 in Jenkins allows remote attackers to inject arbitrary web CVE-2016-31027.3The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugi