PT-2016-1649 · Apache · Apache Struts

Paolo Perliti · Published 2016-04-12 · Updated 2022-05-17 · CVE-2016-2162

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.x through 2.3.25

Description The issue arises from the lack of text sanitization in the Locale object constructed by I18NInterceptor, potentially allowing remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display. This could enable remote attackers to perform cross-site scripting attacks.

Recommendations For versions prior to 2.3.25, update to version 2.3.25 or later to resolve the issue. For versions prior to 2.3.28, update to version 2.3.28 or later to resolve the issue. As a temporary workaround, consider disabling the I18NInterceptor function until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2016-00975

CVE-2016-2162

GHSA-2J4Q-9FFF-236J

Affected Products

Apache Struts

References · 12

• https://osv.dev/vulnerability/CVE-2016-2162 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00975 · Security Note
• https://osv.dev/vulnerability/GHSA-2j4q-9fff-236j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2162 · Security Note
• http://struts.apache.org/docs/s2-030.html · Vendor Advisory
• https://github.com/apache/struts · Note
• https://github.com/apache/struts/blob/f511034acd7b97e07d281169b38e2af40c94903d/core/src/main/java/org/apache/struts2/interceptor/I18nInterceptor.java · Note
• https://github.com/apache/struts/commit/fc2179cf1ac9fbfb61e3430fa88b641d87253327 · Note
• https://web.archive.org/web/20210801130539/http://securitytracker.com/id/1035272 · Note
• https://web.archive.org/web/20210123095722/http://securityfocus.com/bid/85070 · Note
• http://securityfocus.com/bid/85070 · Note
• http://securitytracker.com/id/1035272 · Note