Cross-site Scripting in Apache Struts

Description

References

• nvd.nist.gov/vuln/detail/CVE-2016-4003 · ADVISORY
• apache/struts commit 4720f46 · WEB
• apache/struts commit 5421930 · WEB
• apache/struts commit 72471d7 · WEB
• apache/struts commit 76f1884 · WEB
• apache/struts commit a89bbe2 · WEB
• apache/struts · PACKAGE
• issues.apache.org/jira/browse/WW-4507 · WEB
• web.archive.org/web/20161119142317/http://www.securityfocus.com/bid/86311 · WEB
• web.archive.org/web/20161221184936/http://www.securitytracker.com/id/1035268 · WEB
• struts.apache.org/docs/s2-028.html

Autres vulnérabilités de org.apache.struts:struts2-core

• CVE-2025-68493ÉLEVÉE 8.1Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Str…
• CVE-2025-66675ÉLEVÉE 8.2Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apac…
• CVE-2025-64775ÉLEVÉE 7.5Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apac…
• CVE-2024-53677CRITIQUE 9.8File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circums…
• CVE-2023-50164CRITIQUE 9.8An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious …