NVD

Id
17629  
Name
CVE-2016-1182  
Description
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.  
Reject
 
CVSS Version
2  
CVSS Score
6.4  
Severity
Medium  
CVSS Base Score
6.4  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-07-04  
Modified Date
2016-11-28  
Seq
2016-1182  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
97216 17629 CVE-2016-1182 JVN#65044642  View
97217 17629 CVE-2016-1182 JVNDB-2016-000097  View
97218 17629 CVE-2016-1182 http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html  View
97219 17629 CVE-2016-1182 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html  View
97220 17629 CVE-2016-1182 91067  View
97221 17629 CVE-2016-1182 91787  View
97222 17629 CVE-2016-1182 https://bugzilla.redhat.com/show_bug.cgi?id=1343540  View
97223 17629 CVE-2016-1182 https://github.com/kawasima/struts1-forever/commit/eda3a79907ed8fcb0387a0496d0cb14332f250e8  View
97224 17629 CVE-2016-1182 https://security-tracker.debian.org/tracker/CVE-2016-1182  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
95 JVNDB-2016-000097 Apache Struts 1 における入力値検証機能に関する脆弱性 Apache Struts 1 の Validator には、次の ActionForm もしくはそのサブクラスをセッションスコープに置いている場合、入力値検証に関する設定 (検証ルールやエラーメッセージ) を変更される可能性があります。 CVE-2016-1182 87688 CVE-2016-1182 17629 5.8 4.8 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-000097.html 2016-06-07 2016-12-05 View