CVE-2016-4465: Input Validation
If an application allows enter na URL field in a form and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.
Affected versions: Struts 2.3.20 - Struts 2.3.28.1 and Struts 2.5
External References:
https://struts.apache.org/docs/s2-041.html
Other sources
The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.
— MITRE
The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.13 allows remote attackers to cause a denial of service via a null value for a URL field.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4465?
CVE-2016-4465 has a medium severity due to the potential for denial-of-service attacks when validating specially crafted URLs.
How do I fix CVE-2016-4465?
To remediate CVE-2016-4465, upgrade to Struts versions 2.3.29 or 2.5.13.
What versions are affected by CVE-2016-4465?
CVE-2016-4465 affects Struts versions 2.3.20 to 2.3.28.1 and 2.5.
What type of vulnerability is CVE-2016-4465?
CVE-2016-4465 is a denial-of-service vulnerability caused by improper URL validation.
Can CVE-2016-4465 be exploited remotely?
Yes, CVE-2016-4465 can be exploited remotely if an application improperly validates user-supplied URLs.