CVE-2016-4003: XSS
Published Apr 12, 2016
·Updated
Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter.
Affected Software
2 affected componentsFixes available
maven/org.apache.struts:struts2-core>=2.0.0<2.3.28
2.3.28
Apache struts>=2.0.0<=2.3.24.1
Event History
Apr 12, 2016
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
May 14, 2022
Advisory Published
01:57 AM
Frequently Asked Questions
1
What is the severity of CVE-2016-4003?
CVE-2016-4003 has been classified as a medium severity vulnerability.
2
How do I fix CVE-2016-4003?
To fix CVE-2016-4003, update Apache Struts to version 2.3.28 or higher.
3
What types of attacks does CVE-2016-4003 facilitate?
CVE-2016-4003 allows remote attackers to perform cross-site scripting (XSS) attacks.
4
Which versions of Apache Struts are affected by CVE-2016-4003?
CVE-2016-4003 affects Apache Struts versions from 2.0.0 to 2.3.24.1.
5
What is the main cause of CVE-2016-4003 vulnerability?
The main cause of CVE-2016-4003 is improper handling of multi-byte characters in a url-encoded parameter in the URLDecoder function.