Vulnerability Name:
CVE-2016-3093 (CCN-113686)
Assigned:
2016-05-19
Published:
2016-05-19
Updated:
2023-02-12
Summary:
Apache Struts is vulnerable to a denial of service, caused by the improper implementation of cache used to store method references by the OGNL expression language. An attacker could exploit this vulnerability to block access to a Web site.
CVSS v3 Severity:
5.3 Medium
(CVSS v3.1 Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
)
4.6 Medium
(Temporal CVSS v3.1 Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C
)
Exploitability Metrics:
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope:
Scope (S):
Unchanged
Impact Metrics:
Confidentiality (C):
None
Integrity (I):
None
Availibility (A):
Low
5.3 Medium
(CCN CVSS v3.1 Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
)
4.6 Medium
(CCN Temporal CVSS v3.1 Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C
)
Exploitability Metrics:
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope:
Scope (S):
Unchanged
Impact Metrics:
Confidentiality (C):
None
Integrity (I):
None
Availibility (A):
Low
CVSS v2 Severity:
5.0 Medium
(CVSS v2 Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P
)
Exploitability Metrics:
Access Vector (AV):
Network
Access Complexity (AC):
Low
Authentication (Au):
None
Impact Metrics:
Confidentiality (C):
None
Integrity (I):
None
Availibility (A):
Partial
5.0 Medium
(CCN CVSS v2 Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P
)
Exploitability Metrics:
Access Vector (AV):
Network
Access Complexity (AC):
Low
Athentication (Au):
None
Impact Metrics:
Confidentiality (C):
None
Integrity (I):
None
Availibility (A):
Partial
Vulnerability Consequences:
Denial of Service
References:
Source: MITRE
Type: CNA
CVE-2016-3093
Source: secalert@redhat.com
Type: Vendor Advisory
secalert@redhat.com
Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com
Source: CCN
Type: IBM Security Bulletin 1984206 (Connections)
IBM Connections Mobile Server Security Refresh for Apache Struts (CVE-2016-0785, CVE-2016-0785, CVE-2016-3093, CVE-2016-4003)
Source: CCN
Type: IBM Security Bulletin 1987854 (Opportunity Detect)
Multiple Vulnerabilities in Struts v2 affect IBM Opportunity Detect
Source: CCN
Type: IBM Security Bulletin 1988934 (InfoSphere Information Server)
Multiple Vulnerabilities in Struts v2 affect IBM InfoSphere Information Server
Source: CCN
Type: IBM Security Bulletin 1999781 (Sterling Order Management)
IBM Sterling Order Management is affected by Apache Struts 2 security vulnerabilities (CVE-2016-3093 , CVE-2016-4436)
Source: CCN
Type: BID-90961
Apache Struts CVE-2016-3093 Denial of Service Vulnerability
Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com
Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com
Source: CCN
Type: Apache Struts 2 Documentation S2-034
OGNL cache poisoning can lead to DoS vulnerability
Source: XF
Type: UNKNOWN
apache-struts-cve20163093-dos(113686)
Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com
Source: CCN
Type: IBM Security Bulletin 3106029 (StoredIQ)
Multiple Vulnerabilities identified in IBM StoredIQ
Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2016-3093
Vulnerable Configuration:
Configuration CCN 1
:
cpe:/a:apache:struts:2.0.8:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.0.1:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.0.5:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.0.6:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.0.9:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.0.10:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.0.11:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.0.11.1:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.0.11.2:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.1:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.0.0:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.0.12:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.0.13:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.0.14:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.0.2:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.0.3:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.0.4:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.0.7:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.1.0:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.1.1:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.1.2:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.1.3:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.1.4:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.1.5:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.1.6:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.1.8:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.1.8.1:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.2.1:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.2.1.1:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.2.3:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.3.1:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.3.14.3:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.3.14:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.3.15:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.3.15.3:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.3.8:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.3.7:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.3.4.1:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.3.4:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.3.1.1:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.3.12:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.3.14.1:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.3.15.1:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.3.16:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.3.16.1:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.3.16.2:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.3.16.3:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.3.20:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.3.24:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.3.24.1:*:*:*:*:*:*:*
OR
cpe:/a:apache:struts:2.3.20.3:*:*:*:*:*:*:*
AND
cpe:/a:ibm:infosphere_information_server:8.5:*:*:*:*:*:*:*
OR
cpe:/a:ibm:infosphere_information_server:8.7:*:*:*:*:*:*:*
OR
cpe:/a:ibm:infosphere_information_server:9.1:*:*:*:*:*:*:*
OR
cpe:/a:ibm:connections:4.5:*:*:*:*:*:*:*
OR
cpe:/a:ibm:connections:4.0:*:*:*:*:*:*:*
OR
cpe:/a:ibm:infosphere_information_server:11.3:*:*:*:*:*:*:*
OR
cpe:/a:ibm:connections:5.0:*:*:*:*:*:*:*
OR
cpe:/a:ibm:infosphere_information_server:11.5:*:*:*:*:*:*:*
OR
cpe:/a:ibm:connections:5.5:*:*:*:*:*:*:*
OR
cpe:/a:ibm:storediq:7.6.0:*:*:*:*:*:*:*
Denotes that component is vulnerable
Oval Definitions
Definition ID
Class
Title
Last Modified
oval:com.ubuntu.precise:def:20163093000
V
CVE-2016-3093 on Ubuntu 12.04 LTS (precise) - low.
2016-06-07
oval:com.ubuntu.trusty:def:20163093000
V
CVE-2016-3093 on Ubuntu 14.04 LTS (trusty) - low.
2016-06-07
BACK
apache
struts 2.0.8
apache
struts 2.0.1
apache
struts 2.0.5
apache
struts 2.0.6
apache
struts 2.0.9
apache
struts 2.0.10
apache
struts 2.0.11
apache
struts 2.0.11.1
apache
struts 2.0.11.2
apache
struts 2.1
apache
struts 2.0.0
apache
struts 2.0.12
apache
struts 2.0.13
apache
struts 2.0.14
apache
struts 2.0.2
apache
struts 2.0.3
apache
struts 2.0.4
apache
struts 2.0.7
apache
struts 2.1.0
apache
struts 2.1.1
apache
struts 2.1.2
apache
struts 2.1.3
apache
struts 2.1.4
apache
struts 2.1.5
apache
struts 2.1.6
apache
struts 2.1.8
apache
struts 2.1.8.1
apache
struts 2.2.1
apache
struts 2.2.1.1
apache
struts 2.2.3
apache
struts 2.3.1
apache
struts 2.3.14.3
apache
struts 2.3.14
apache
struts 2.3.15
apache
struts 2.3.15.3
apache
struts 2.3.8
apache
struts 2.3.7
apache
struts 2.3.4.1
apache
struts 2.3.4
apache
struts 2.3.1.1
apache
struts 2.3.12
apache
struts 2.3.14.1
apache
struts 2.3.15.1
apache
struts 2.3.16
apache
struts 2.3.16.1
apache
struts 2.3.16.2
apache
struts 2.3.16.3
apache
struts 2.3.20
apache
struts 2.3.24
apache
struts 2.3.24.1
apache
struts 2.3.20.3
ibm
infosphere information server 8.5
ibm
infosphere information server 8.7
ibm
infosphere information server 9.1
ibm
connections 4.5
ibm
connections 4.0
ibm
infosphere information server 11.3
ibm
connections 5.0
ibm
infosphere information server 11.5
ibm
connections 5.5
ibm
storediq 7.6.0