description: In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
problem types: A possible Remote Code Execution attack when using an unintentional expression in Freemarker tag instead of string literals
affected:
{
product: Apache Struts
vendor: Apache Software Foundation
versions:
status: affected, version: 2.0.0 - 2.3.33
status: affected, version: 2.5 - 2.5.10.1
}