CVE-2016-1182 — Vulnerability intelligence

apache — struts

Published: 2016-07-04T22:59:02.880

CVSS

8.2

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

Sources

• CVE-2016-1182
• Issue Tracking
• Issue Tracking, Patch
• Third Party Advisory
• Third Party Advisory
• Original advisory
• Original advisory
• Original advisory
• Patch
• Original advisory