Vulnerability Description
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Struts | 1.0 |
Related Weaknesses (CWE)
References
- http://jvn.jp/en/jp/JVN65044642/index.htmlVendor Advisory
- http://jvndb.jvn.jp/jvndb/JVNDB-2016-000097Third Party AdvisoryVDB EntryVendor Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlPatch
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlPatchThird Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlPatch
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlPatchThird Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlPatch
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlPatch
- http://www.securityfocus.com/bid/91067Third Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/91787Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1036056Third Party AdvisoryVDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1343540Issue Tracking
- https://github.com/kawasima/struts1-forever/commit/eda3a79907ed8fcb0387a0496d0cbIssue TrackingPatch
- https://security-tracker.debian.org/tracker/CVE-2016-1182Third Party Advisory
- https://security.netapp.com/advisory/ntap-20180629-0006/Third Party Advisory
FAQ
What is CVE-2016-1182?
CVE-2016-1182 is a vulnerability with a CVSS score of 8.2 (HIGH). ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a ...
How severe is CVE-2016-1182?
CVE-2016-1182 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-1182?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Struts.