CVE-2016-4430 Apache Struts CSRF Vulnerability
HighCVSS 8.8
EPSS 3.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.struts.xwork/xwork-core(Maven) | >= 2.3.20, <= 2.3.28.1 | No fix listed |
| org.apache.struts.xwork/xwork-core(Maven) | >= 2.3.20, < 2.3.29 | 2.3.29 |
| org.apache.struts.xwork/xwork-core(Maven) | = 2.3.20 | No fix listed |
| org.apache.struts.xwork/xwork-core(Maven) | = 2.3.20.1 | No fix listed |
| org.apache.struts.xwork/xwork-core(Maven) | = 2.3.20.3 | No fix listed |
| org.apache.struts.xwork/xwork-core(Maven) | = 2.3.24 | No fix listed |
| org.apache.struts.xwork/xwork-core(Maven) | = 2.3.24.1 | No fix listed |
| org.apache.struts.xwork/xwork-core(Maven) | = 2.3.24.3 | No fix listed |
| org.apache.struts.xwork/xwork-core(Maven) | = 2.3.28 | No fix listed |
| org.apache.struts.xwork/xwork-core(Maven) | = 2.3.28.1 | No fix listed |
| apache struts | = 2.3.20 | No fix listed |
| apache struts | = 2.3.20.1 | No fix listed |
| apache struts | = 2.3.20.3 | No fix listed |
| apache struts | = 2.3.24 | No fix listed |
| apache struts | = 2.3.24.1 | No fix listed |
| apache struts | = 2.3.24.3 | No fix listed |
| apache struts | = 2.3.28 | No fix listed |
| apache struts | = 2.3.28.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking
- struts.apache.org vendor-advisory
- JVN#45093481 third-party-advisory vendor-advisory
- JVNDB-2016-000111 third-party-advisory vdb-entry vendor-advisory
- www-01.ibm.com third-party-advisory
- www-01.ibm.com third-party-advisory
- www.oracle.com
- web.archive.org
- github.com patch
- github.com
- github.com product
- 91281 vdb-entry