PT-2015-3439 · Oracle+1 · Java Runtime Environment+2

Published 2015-09-01 · Updated 2022-05-14 · CVE-2016-4003

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Java Runtime Environment versions prior to 1.8 Java Development Kit versions prior to 1.8

Description The issue is related to the implementation of the URLDecoder class in Java Runtime Environment and Java Development Kit, specifically when using single-byte page encoding. This allows a remote attacker to conduct cross-site scripting attacks by injecting arbitrary web script or HTML via multi-byte characters in a URL-encoded parameter.

Recommendations For Java Runtime Environment versions prior to 1.8, update to version 1.8 or later to resolve the issue. For Java Development Kit versions prior to 1.8, update to version 1.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of the URLDecoder function until a patch is available. Avoid using multi-byte characters in URL-encoded parameters for the affected versions.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-05819

CVE-2016-4003

GHSA-M3X6-9V6H-4G28

Affected Products

Apache Struts

Java Development Kit

Java Runtime Environment

References · 19

• https://osv.dev/vulnerability/CVE-2016-4003 · Vendor Advisory
• https://issues.apache.org/jira/browse/WW-4507 · Vendor Advisory
• http://struts.apache.org/docs/s2-028.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4003 · Security Note
• https://bdu.fstec.ru/vul/2022-05819 · Security Note
• https://osv.dev/vulnerability/GHSA-m3x6-9v6h-4g28 · Vendor Advisory
• https://github.com/apache/struts · Note
• https://github.com/apache/struts/commit/72471d7075681bea52046645ad7aa34e9c53751e · Note
• https://github.com/apache/struts/commit/5421930b49822606792f36653b17d3d95ef106f9 · Note
• https://github.com/apache/struts/commit/76f188406eb9f17a06afcb5f49f0c44d749da0d2 · Note
• https://github.com/apache/struts/commit/a89bbe22cd2461748d595a89a254de888a415e6c · Note
• https://github.com/apache/struts/commit/4720f46a63caaf9db97ba27dc51ac5ad21e66bdc · Note
• https://git-wip-us.apache.org/repos/asf?p=struts.git;h=72471d7 · Note
• https://web.archive.org/web/20161221184936/http://securitytracker.com/id/1035268 · Note
• https://ibm.com/blogs/psirt/security-bulletin-ibm-call-center-and-apache-struts-struts-upgrade-strategy-various-cves-see-below · Note