GitHub Advisoryadvisory · Maven

GHSA-5ggr-mpgw-3mgx Improper Input Validation in Apache Struts

HIGH Published 2022-05-13 Modified 2025-10-13 Official page ↗
Aliases
CVE-2016-1182
Ecosystem
Maven
Packages
org.apache.struts:struts-core, struts:struts
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Weaknesses
CWE-20
Reviewed
2022-07-06

Affected packages

• Maven org.apache.struts:struts-core: <= 1.3.10 (no fix yet) • Maven struts:struts: <= 1.2.9 (no fix yet)

Description

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

Related

Alias · CVE (1)

  • CVE-2016-1182 ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References