CVE-2016-4461

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.x through 2.3.28

Description The issue allows remote attackers to execute arbitrary code via a %{} sequence in a tag attribute, also known as forced double OGNL evaluation. This is due to insufficient input validation. The vulnerability can be exploited by a remote attacker to execute arbitrary code using the %{} sequence in a tag attribute.

Recommendations For Apache Struts versions 2.x through 2.3.28, update to version 2.3.29 or later to resolve the issue. As a temporary workaround, consider restricting the use of tag attributes that may contain the %{} sequence to minimize the risk of exploitation.