CVE-2016-1181: banking platform 2.3.0, 2.4.0, 2.4.1 (+1 more affected versions); +3 more affected products

Affected technology

banking platform · 2.3.0
oracle

banking platform · 2.4.0
oracle

banking platform · 2.4.1
oracle

banking platform · 2.5.0
oracle

portal · 11.1.1.6
oracle

struts · 1.0
apache

struts · 1.0 · update beta1
apache

struts · 1.0 · update beta2
apache

struts · 1.0 · update beta3
apache

struts · 1.0.1
apache

struts · 1.0.2
apache

struts · 1.1
apache

struts · 1.1 · update b1
apache

struts · 1.1 · update b2
apache

struts · 1.1 · update b3
apache

struts · 1.1 · update rc1
apache

struts · 1.1 · update rc2
apache

struts · 1.2.0
apache

struts · 1.2.1
apache

struts · 1.2.2
apache

struts · 1.2.3
apache

struts · 1.2.4
apache

struts · 1.2.5
apache

struts · 1.2.6
apache

struts · 1.2.7
apache

struts · 1.2.8
apache

struts · 1.2.9
apache

struts · 1.3.5
apache

struts · 1.3.6
apache

struts · 1.3.7
apache

struts · 1.3.8
apache

struts · 1.3.9
apache

struts · 1.3.10
apache

n/a · n/a
Vendor not specified by the source

Description’s affected range: through 1.3.10 mishandles multithreaded access to an ActionForm instance, which

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Remote attackers can execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899. NVD’s CVSS 3.0 assessment (base score 8.1/10) rates confidentiality, integrity and availability impact as high.