CVE-2016-4461: Apache Struts forced double OGNL evaluation

May 14, 2022 (updated April 23, 2025)

Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a “%{}” sequence in a tag attribute, aka forced double OGNL evaluation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0785.

References

github.com/advisories/GHSA-864w-r5qj-h6fj
github.com/apache/struts
nvd.nist.gov/vuln/detail/CVE-2016-4461
security.netapp.com/advisory/ntap-20180629-0004
struts.apache.org/docs/s2-036.html

Code Behaviors & Features

Detect and mitigate CVE-2016-4461 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →