Cross-site Scripting in Apache Struts

MEDIUM 6.1CVE-2016-4003 · GHSA-m3x6-9v6h-4g28 · Published 12/04/2016 · updated 17/06/2026

Package	Affected versions	Patched versions
org.apache.struts:struts2-core Maven	`≥ 2.0.0, < 2.3.28`	`2.3.28`
struts apache	`≥ 2.0.0, ≤ 2.3.24.1`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2016-4003 · ADVISORY
apache/struts commit 4720f46 · WEB
apache/struts commit 5421930 · WEB
apache/struts commit 72471d7 · WEB
apache/struts commit 76f1884 · WEB
apache/struts commit a89bbe2 · WEB
apache/struts · PACKAGE
issues.apache.org/jira/browse/WW-4507 · WEB
web.archive.org/web/20161119142317/http://www.securityfocus.com/bid/86311 · WEB
web.archive.org/web/20161221184936/http://www.securitytracker.com/id/1035268 · WEB
struts.apache.org/docs/s2-028.html · WEB
securityfocus.com/bid/86311 · Third Party Advisory
securitytracker.com/id/1035268 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free