CVE-2016-1182

Опубликовано: 04 июл. 2016

Источник: nvd

CVSS3: 8.2

CVSS2: 6.4

EPSS Низкий

Описание

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

Ссылки

http://jvn.jp/en/jp/JVN65044642/index.html
Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000097
Third Party Advisory
VDB Entry
Vendor Advisory
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
Patch
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
Patch
Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
Patch
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
Patch
Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
Patch
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Patch
http://www.securityfocus.com/bid/91067
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/91787
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1036056
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1343540
Issue Tracking
https://github.com/kawasima/struts1-forever/commit/eda3a79907ed8fcb0387a0496d0cb14332f250e8
Issue Tracking
Patch
https://security-tracker.debian.org/tracker/CVE-2016-1182
Third Party Advisory
https://security.netapp.com/advisory/ntap-20180629-0006/
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
Patch
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:struts:1.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.0:beta1:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.0:beta2:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.0:beta3:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.0.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.0.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.1:b1:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.1:b2:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.1:b3:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.1:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.1:rc2:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.2.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.2.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.2.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.2.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.2.4:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.2.5:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.2.6:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.2.7:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.2.8:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.2.9:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.3.5:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.3.6:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.3.7:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.3.8:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.3.9:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:1.3.10:*:*:*:*:*:*:*

EPSS

Процентиль: 83%

0.01857

Низкий

8.2 High

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-20

Связанные уязвимости

CVE-2016-1182

CVSS3: 8.2

ubuntu

больше 9 лет назад

CVE-2016-1182

redhat

больше 9 лет назад

CVE-2016-1182

CVSS3: 8.2

debian

больше 9 лет назад

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not prop ...

GHSA-5ggr-mpgw-3mgx

CVSS3: 8.2

github

больше 3 лет назад

Improper Input Validation in Apache Struts

BDU:2016-01713

fstec

больше 9 лет назад

Уязвимость программной платформы Apache Struts, позволяющая нарушителю вызвать отказ в обслуживании или провести XSS-атаки

EPSS

Процентиль: 83%

0.01857

Низкий

8.2 High

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-20