CVE-2016-8738

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2016-8738
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-8738.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-8738
Aliases
Published
2017-09-20T17:29:00Z
Modified
2024-09-03T01:29:00.648710Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.

References

Affected packages

Git / github.com/apache/struts

Affected ranges

Type
GIT
Repo
https://github.com/apache/struts
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
12cc861875665e19c9d72a131f606a9b855b5c80
Last affected
17e14ef42bcf1182c2985f2a25543cf4e88235e2
Last affected
4bee55fee30086c786d09503125a2b1c2ae8dcfa
Last affected
c6a0ea2dcd6ea94bf551ed200955724013c34d3b
Last affected
e8aa825f21fc951418f0cfa770d32762a4a83664
Last affected
f2348e53cbdf8ad7d9c28c66dc6fefe2c5718636

Affected versions

Other

STRUTS_2_2_1
STRUTS_2_3_14
STRUTS_2_3_16_1
STRUTS_2_3_16_2
STRUTS_2_3_16_3
STRUTS_2_3_17
STRUTS_2_3_19
STRUTS_2_3_20
STRUTS_2_3_20_1
STRUTS_2_3_21
STRUTS_2_3_22
STRUTS_2_3_23
STRUTS_2_3_24
STRUTS_2_3_24_1
STRUTS_2_5
STRUTS_2_5_1
STRUTS_2_5_2
STRUTS_2_5_3
STRUTS_2_5_4
STRUTS_2_5_BETA1
STRUTS_2_5_BETA2
STRUTS_2_5_BETA3