CVE-2016-4430: CSRF
Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.
Other sources
It was found that it is possible to pass a malicious expression which can be used to bypass token validation and perform CSRF attack.
External References:
https://struts.apache.org/docs/s2-038.html
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4430?
CVE-2016-4430 is classified as a critical vulnerability due to its potential for enabling cross-site request forgery (CSRF) attacks.
How do I fix CVE-2016-4430?
To mitigate CVE-2016-4430, upgrade your Apache Struts installation to version 2.3.29 or later.
Which versions of Apache Struts are affected by CVE-2016-4430?
CVE-2016-4430 affects Apache Struts versions 2.3.20 through 2.3.28.1.
Can CVE-2016-4430 be exploited remotely?
Yes, CVE-2016-4430 can be exploited remotely by attackers to conduct CSRF attacks.
What kind of attack does CVE-2016-4430 facilitate?
CVE-2016-4430 facilitates cross-site request forgery (CSRF) attacks due to improper token validation.