Vulnerability Name: | CVE-2016-8738 (CCN-132455) | ||||||||||||
Assigned: | 2016-10-18 | ||||||||||||
Published: | 2016-10-18 | ||||||||||||
Updated: | 2018-07-01 | ||||||||||||
Summary: | In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. | ||||||||||||
CVSS v3 Severity: | 5.9 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) 5.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
| ||||||||||||
CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
| ||||||||||||
Vulnerability Type: | CWE-20 | ||||||||||||
Vulnerability Consequences: | Denial of Service | ||||||||||||
References: | Source: MITRE Type: CNA CVE-2016-8738 Source: BID Type: Third Party Advisory, VDB Entry 94657 Source: CCN Type: BID-94657 Apache Struts CVE-2016-8738 Denial of Service Vulnerability Source: XF Type: UNKNOWN apache-struts-cve20168738-dos(132455) Source: CONFIRM Type: UNKNOWN https://security.netapp.com/advisory/ntap-20180629-0003/ Source: CCN Type: Apache Struts 2 Documentation S2-044 Possible DoS attack when using URLValidator Source: CONFIRM Type: Mitigation, Patch, Vendor Advisory https://struts.apache.org/docs/s2-044.html Source: CCN Type: WhiteSource Vulnerability Database CVE-2016-8738 | ||||||||||||
Vulnerable Configuration: | Configuration 1: Configuration CCN 1: ![]() | ||||||||||||
Oval Definitions | |||||||||||||
| |||||||||||||
BACK |