PT-2016-1649 · Apache · Apache Struts

Paolo Perliti · Publicado 2016-04-12 · Atualizado 2022-05-17 · CVE-2016-2162

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.x through 2.3.25

Description The issue arises from the lack of text sanitization in the Locale object constructed by I18NInterceptor, potentially allowing remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display. This could enable remote attackers to perform cross-site scripting attacks.

Recommendations For versions prior to 2.3.25, update to version 2.3.25 or later to resolve the issue. For versions prior to 2.3.28, update to version 2.3.28 or later to resolve the issue. As a temporary workaround, consider disabling the I18NInterceptor function until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2016-00975

CVE-2016-2162

GHSA-2J4Q-9FFF-236J

Produtos afetados

Apache Struts

Referências · 12

• https://github.com/apache/struts · Nota
• https://github.com/apache/struts/blob/f511034acd7b97e07d281169b38e2af40c94903d/core/src/main/java/org/apache/struts2/interceptor/I18nInterceptor.java · Nota
• https://github.com/apache/struts/commit/fc2179cf1ac9fbfb61e3430fa88b641d87253327 · Nota
• https://osv.dev/vulnerability/CVE-2016-2162 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-00975 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-2j4q-9fff-236j · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-2162 · Nota de Segurança
• https://web.archive.org/web/20210801130539/http://securitytracker.com/id/1035272 · Nota
• https://web.archive.org/web/20210123095722/http://securityfocus.com/bid/85070 · Nota
• http://struts.apache.org/docs/s2-030.html · Aviso do Fabricante
• http://securityfocus.com/bid/85070 · Nota
• http://securitytracker.com/id/1035272 · Nota