Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via
    vectors related to improper action name clean up. (CVE-2016-4436)

According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 3.1.x prior to 3.1.7.8023, 3.2.x prior to 3.2.7.1204, or 3.3.x prior to 3.3.3.1199. It is, therefore, affected by multiple vulnerabilities :

  - A denial of service vulnerability exists in the Apache     Commons component in the FileUpload functionality due to     improper handling of file upload requests. An     unauthenticated, remote attacker can exploit this, via a     specially crafted content-type header, to cause a denial     of service condition. Note that this vulnerability does     not affect MySQL Enterprise Monitor versions 3.3.x.
    (CVE-2016-3092)

  - An unspecified flaw exists in the Apache Struts     component that is triggered during the cleanup of action     names. An unauthenticated, remote attacker can exploit     this, via a specially crafted payload, to perform     unspecified actions. (CVE-2016-4436)

  - A carry propagation error exists in the OpenSSL     component in the Broadwell-specific Montgomery     multiplication procedure when handling input lengths     divisible by but longer than 256 bits. This can result     in transient authentication and key negotiation failures     or reproducible erroneous outcomes of public-key     operations with specially crafted input. A     man-in-the-middle attacker can possibly exploit this     issue to compromise ECDH key negotiations that utilize     Brainpool P-512 curves. (CVE-2016-7055)

  - An unspecified flaw exists in the Monitoring Server     subcomponent that allows an authenticated, remote     attacker to impact confidentiality and integrity.
    (CVE-2017-3306)

  - An unspecified flaw exists in the Monitoring Server     subcomponent that allows an authenticated, remote     attacker to impact integrity and availability.
    (CVE-2017-3307)

  - An out-of-bounds read error exists in the OpenSSL     component when handling packets using the     CHACHA20/POLY1305 or RC4-MD5 ciphers. An     unauthenticated, remote attacker can exploit this, via     specially crafted truncated packets, to cause a denial     of service condition. (CVE-2017-3731)

  - A carry propagating error exists in the OpenSSL     component in the x86_64 Montgomery squaring     implementation that may cause the BN_mod_exp() function     to produce incorrect results. An unauthenticated, remote     attacker with sufficient resources can exploit this to     obtain sensitive information regarding private keys.
    (CVE-2017-3732)

  - A remote code execution vulnerability exists in the     Apache Struts component in the Jakarta Multipart parser     due to improper handling of the Content-Type,     Content-Disposition, and Content-Length headers.
    An unauthenticated, remote attacker can exploit this,     via a specially crafted header value in the HTTP     request, to execute arbitrary code. (CVE-2017-5638)

The version of Apache Struts running on the remote Windows host is 2.x prior to 2.3.29. It is, therefore, affected by the following vulnerabilities :

  - A remote code execution vulnerability exists due to     erroneously performing double OGNL evaluation of     attribute values assigned to certain tags. An     unauthenticated, remote attacker can exploit this, via a     specially crafted request, to execute arbitrary code.
    (CVE-2016-0785)

  - A cross-site request forgery (XSRF) vulnerability exists     due to improper validation of session tokens. An     unauthenticated, remote attacker can exploit this, via a     malicious OGNL expression, to bypass token validation     and perform an XSRF attack. (CVE-2016-4430)

  - Multiple input validation issues exists that allow     internal security mechanisms to be bypassed, allowing     the manipulation of a return string which can be used to     redirect users to a malicious website. This affects both     the default action method the 'getter' action method.
    (CVE-2016-4431, CVE-2016-4433)

  - An unspecified flaw exists that is triggered during the     cleanup of action names. An unauthenticated, remote     attacker can exploit this, via a specially crafted     payload, to perform unspecified actions. (CVE-2016-4436)

  - A remote code execution vulnerability exists in the REST     plugin due to improper handling of OGNL expressions. An     unauthenticated, remote attacker can exploit this, via     a specially crafted OGNL expression, to execute     arbitrary code. (CVE-2016-4438)

  - A remote code execution vulnerability exists in user tag     attributes due to improper handling of OGNL expressions.     An unauthenticated, remote attacker can exploit this,     via a specially crafted double OGNL evaluation, to     execute arbitrary code. (CVE-2016-4461)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
432876	SCA: security update for org.apache.struts:struts2-core (GHSA-xm92-v2mq-842q)	Tenable Cloud Security	SCA Checks	Local	critical
432876	SCA: security update for org.apache.struts:struts2-core (GHSA-xm92-v2mq-842q)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
99593	MySQL Enterprise Monitor 3.1.x < 3.1.7.8023 / 3.2.x < 3.2.7.1204 / 3.3.x < 3.3.3.1199 Multiple Vulnerabilities (April 2017 CPU)	Nessus	CGI abuses	Remote	critical
91812	Apache Struts 2.x < 2.3.29 Multiple Vulnerabilities (S2-035 - S2-040)	Nessus	Misc.	Combined	high

Detections

Analytics

CVE-2016-4436

critical

Tenable Plugins

critical

critical

critical

high