6.4
CVSSv2

CVE-2016-1182

Published: 04/07/2016 Updated: 23/04/2019
CVSS v2 Base Score: 6.4 | Impact Score: 4.9 | Exploitability Score: 10
CVSS v3 Base Score: 8.2 | Impact Score: 4.2 | Exploitability Score: 3.9
VMScore: 570
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P

Vulnerability Summary

ActionServlet.java in Apache Struts 1 1.x up to and including 1.3.10 does not properly restrict the Validator configuration, which allows remote malicious users to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

Vulnerability Trend

Affected Products

Vendor Product Versions
ApacheStruts1.0, 1.0.1, 1.0.2, 1.1, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7, 1.2.8, 1.2.9, 1.3.5, 1.3.6, 1.3.7, 1.3.8, 1.3.9, 1.3.10

Vendor Advisories

ActionServletjava in Apache Struts 1 1x through 1310 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899 ...
Oracle Critical Patch Update Advisory - July 2016 Description A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous C ...
Multiple security vulnerabilities have been identified and fixed in the IBM Security Privileged Identity Manager Appliance ...

Github Repositories

struts-mini Security patch for struts 138 Struts 1 already stop official supporting for many years In these years, a few critical security vulnerabilities were found in struts 1 This project is a security patch for struts 138, below security vulnerabilities are solved: CVE-2016-1182 ActionServletjava in Apache Struts 1 1x through 1310 does not properly restrict the Va