|
Description: | | Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions. |
|
Impact: | | An attacker can execute arbitrary code via a successful exploit in the context of the vulnerable software. |
|
Affected OS: | | Network Device, Solaris, FreeBSD, Windows, Mac OS, Other Unix, Linux, Others |
|
Reference: | | SecurityFocusBID:87327 SecurityFocusBID:91787 SecurityTrackerID:1035665 https://struts.apache.org/docs/s2-032.html ExploitDB:39756
|
|