CVE-2016-1182: struts 1.0, 1.0.1, 1.0.2 (+17 more affected versions); +1 more affected products

Affected technology

struts · 1.0
apache

struts · 1.0 · update beta1
apache

struts · 1.0 · update beta2
apache

struts · 1.0 · update beta3
apache

struts · 1.0.1
apache

struts · 1.0.2
apache

struts · 1.1
apache

struts · 1.1 · update b1
apache

struts · 1.1 · update b2
apache

struts · 1.1 · update b3
apache

struts · 1.1 · update rc1
apache

struts · 1.1 · update rc2
apache

struts · 1.2.0
apache

struts · 1.2.1
apache

struts · 1.2.2
apache

struts · 1.2.3
apache

struts · 1.2.4
apache

struts · 1.2.5
apache

struts · 1.2.6
apache

struts · 1.2.7
apache

struts · 1.2.8
apache

struts · 1.2.9
apache

struts · 1.3.5
apache

struts · 1.3.6
apache

struts · 1.3.7
apache

struts · 1.3.8
apache

struts · 1.3.9
apache

struts · 1.3.10
apache

n/a · n/a
Vendor not specified by the source

Description’s affected range: through 1.3.10 does not properly restrict the Validator configuration, which

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Remote attackers can conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899. NVD’s CVSS 3.0 assessment (base score 8.2/10) rates confidentiality impact as none; integrity impact as low; availability impact as high.