{"action":"Upgrade org.apache.struts:struts2-core to 2.3.29 or later.","affected":[{"fixed":"2.3.29","introduced":"2.0.0"}],"component":"org.apache.struts:struts2-core","cve_ids":["CVE-2016-4461"],"ecosystem":"Maven","epss":0.08085,"exploited":false,"fixed_versions":["2.3.29"],"ghsa_id":"GHSA-864w-r5qj-h6fj","id":"tcs_01M5N8KZ2RH8F5A910XKY5KJHS","modified_at":"2025-04-23T03:57:12.615393Z","published_at":"2022-05-14T01:05:57Z","references":["https://osv.dev/vulnerability/GHSA-864w-r5qj-h6fj","https://nvd.nist.gov/vuln/detail/CVE-2016-4461","https://github.com/apache/struts","https://security.netapp.com/advisory/ntap-20180629-0004","https://struts.apache.org/docs/s2-036.html"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-864w-r5qj-h6fj","url":"https://osv.dev/vulnerability/GHSA-864w-r5qj-h6fj"}],"summary":"Apache Struts forced double OGNL evaluation"}