First published: Tue Apr 12 2016(Updated: )
Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
maven/org.apache.struts:struts2-core | >=2.0.0<2.3.28 | 2.3.28 |
Apache Struts 2 | >=2.0.0<=2.3.24.1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2016-4003 has been classified as a medium severity vulnerability.
To fix CVE-2016-4003, update Apache Struts to version 2.3.28 or higher.
CVE-2016-4003 allows remote attackers to perform cross-site scripting (XSS) attacks.
CVE-2016-4003 affects Apache Struts versions from 2.0.0 to 2.3.24.1.
The main cause of CVE-2016-4003 is improper handling of multi-byte characters in a url-encoded parameter in the URLDecoder function.