CVE-2016-1181
High · 8.1CVSS
8.1
EPSS
13.1%
Published
Jul 4, 2016
CISA due date
—
The record
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.struts:struts-core | 0 | No fix |
| Maven | struts:struts | 0 | No fix |
| Mageia:5 | struts | 0 | 1.3.10-8.2.mga5 |
| maven | struts/struts | 1.0.2 | No fix |
| maven | struts/struts | 1.1 | No fix |
| maven | struts/struts | 1.3.5 | No fix |
Related vulnerabilities
- CVE-2016-1182 ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the… Also affects org.apache.struts:struts-core
- CVE-2015-0899 The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote… Also affects org.apache.struts:struts-core
- CVE-2012-1007 Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote… Also affects org.apache.struts:struts-core
- CVE-2005-3745 Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other… Also affects org.apache.struts:struts-core
- CVE-2006-1547 ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7… Also affects struts:struts