CVE-2016-1182 — 脆弱性インテリジェンス

apache — struts

公表日: 2016-07-04T22:59:02.880

CVSS

8.2

CISA KEV

未掲載（悪用がないことを意味しません）

情報源の原文（翻訳ではありません）

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

情報源

• CVE-2016-1182
• Issue Tracking
• Issue Tracking, Patch
• Third Party Advisory
• Third Party Advisory
• Original advisory
• Original advisory
• Original advisory
• Patch
• Original advisory