CVE-2016-8738

In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
apacheCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 62%
VendorProductVersion
apachestruts
2.5
apachestruts
2.5.1
apachestruts
2.5.2
apachestruts
2.5.3
apachestruts
2.5.4
apachestruts
2.5.5
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libstruts1.2-java
cosmic
dne
bionic
dne
artful
dne
zesty
dne
xenial
dne
trusty
dne
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/94657
https://security.netapp.com/advisory/ntap-20180629-0003/
https://struts.apache.org/docs/s2-044.html
http://www.securityfocus.com/bid/94657
https://security.netapp.com/advisory/ntap-20180629-0003/
https://struts.apache.org/docs/s2-044.html