CVE-2016-4465 Apache Struts vulnerable to possible DoS attack when using URLValidator
MediumCVSS 5.3
EPSS 10.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.struts/struts2-core(Maven) | >= 2.3.20, < 2.3.29 | 2.3.29 |
| org.apache.struts/struts2-core(Maven) | = 2.3.20 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.20.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.20.3 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.24 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.24.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.24.3 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.28 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.28.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | >= 2.5.0, < 2.5.13 | 2.5.13 |
| org.apache.struts/struts2-core(Maven) | = 2.5 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.5.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.5.10 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.5.10.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.5.12 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.5.2 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.5.5 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.5.8 | No fix listed |
| apache struts | = 2.3.20 | No fix listed |
| apache struts | = 2.3.20.1 | No fix listed |
| apache struts | = 2.3.20.3 | No fix listed |
| apache struts | = 2.3.24 | No fix listed |
| apache struts | = 2.3.24.1 | No fix listed |
| apache struts | = 2.3.24.3 | No fix listed |
| apache struts | = 2.3.28 | No fix listed |
Show 5 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apache struts | = 2.3.28.1 | No fix listed |
| apache struts | = 2.5 | No fix listed |
| apache struts | = 2.5-beta1 | No fix listed |
| apache struts | = 2.5-beta2 | No fix listed |
| apache struts | = 2.5-beta3 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- bugzilla.redhat.com issue-tracking
- github.com product
- struts.apache.org vendor-advisory
- JVN#12352818 third-party-advisory vendor-advisory
- JVNDB-2016-000114 third-party-advisory vdb-entry vendor-advisory
- www-01.ibm.com third-party-advisory
- github.com
- www.oracle.com
- 91278 vdb-entry