CVE-2016-1182: Input Validation
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.
Other sources
It was reported that The Apache Struts 1 Validator contains a vulnerability where input validation configurations (validation rules, error messages, etc.) may be modified. This occurs when ValidatorForm and ValidatorActionForm (including its subclasses) are in the session scope.
Affects Apache Struts 1 versions 1.0 through 1.3.10.
External References:
https://jvn.jp/en/jp/JVN65044642/
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1182?
CVE-2016-1182 is considered to have a moderate severity rating due to its potential for causing cross-site scripting (XSS) attacks and denial of service.
How do I fix CVE-2016-1182?
To fix CVE-2016-1182, upgrade to a version of Apache Struts that is later than 1.3.10 where the issue has been resolved.
What types of attacks can be conducted with CVE-2016-1182?
CVE-2016-1182 allows attackers to conduct cross-site scripting (XSS) attacks or cause denial of service via crafted input.
Which versions of Apache Struts are affected by CVE-2016-1182?
CVE-2016-1182 affects Apache Struts versions from 1.0 through 1.3.10.
Is CVE-2016-1182 related to any other vulnerabilities?
Yes, CVE-2016-1182 is related to CVE-2015-0899, as they both involve similar issues of input validation.