← Back

CVE-2016-1182

nvd nist
Published: Jul 4, 2016Modified: May 6, 2026

JSON object

Loading...
8.2
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Exploitability: 3.9 / Impact: 4.2
Source: NVD

Description

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

Affected (28)

Products: Apache: Struts
Apache
1 product
Struts
Configuration A
28 vulnerable
Vulnerable SoftwareAffected Versions
Apache
Struts
Version 1.0.1
Struts
Version 1.0.2
Struts
Version 1.0
Struts
Version 1.0 beta1
Struts
Version 1.0 beta2
Struts
Version 1.0 beta3
Struts
Version 1.1
Struts
Version 1.1 b1
Struts
Version 1.1 b2
Struts
Version 1.1 b3
Struts
Version 1.1 rc1
Struts
Version 1.1 rc2
Struts
Version 1.2.0
Struts
Version 1.2.1
Struts
Version 1.2.2
Struts
Version 1.2.3
Struts
Version 1.2.4
Struts
Version 1.2.5
Struts
Version 1.2.6
Struts
Version 1.2.7
Struts
Version 1.2.8
Struts
Version 1.2.9
Struts
Version 1.3.10
Struts
Version 1.3.5
Struts
Version 1.3.6
Struts
Version 1.3.7
Struts
Version 1.3.8
Struts
Version 1.3.9

Related CWEs

CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (40)

Source: vultures@jpcert.or.jp
Vendor Advisory
Source: vultures@jpcert.or.jp
Third Party AdvisoryVDB EntryVendor Advisory
Source: vultures@jpcert.or.jp
Patch
Source: vultures@jpcert.or.jp
PatchThird Party Advisory
Source: vultures@jpcert.or.jp
Patch
Source: vultures@jpcert.or.jp
PatchThird Party Advisory
Source: vultures@jpcert.or.jp
Patch
Source: vultures@jpcert.or.jp
Patch
Source: vultures@jpcert.or.jp
Third Party AdvisoryVDB Entry
Source: vultures@jpcert.or.jp
Third Party AdvisoryVDB Entry
Source: vultures@jpcert.or.jp
Third Party AdvisoryVDB Entry
Source: vultures@jpcert.or.jp
Issue Tracking
Source: vultures@jpcert.or.jp
Issue TrackingPatch
Source: vultures@jpcert.or.jp
Third Party Advisory
Source: vultures@jpcert.or.jp
Third Party Advisory
Source: vultures@jpcert.or.jp
Source: vultures@jpcert.or.jp
Source: vultures@jpcert.or.jp
Source: vultures@jpcert.or.jp
Patch
Source: vultures@jpcert.or.jp
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB EntryVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Issue Tracking
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingPatch
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.