Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Apache
Information Disclosure
Oracle
Struts
Archiva
+9
NVD
Exploit-DB
VulDB
CVSS 3.1
9.8
EPSS
94.3%
Threat
7.8