« Volver al listado

CVE-2016-8738

Estado: ModificadaMedia (5.9)—

In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Struts

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-8738",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Struts",
          "versions": [
            {
              "status": "affected",
              "version": "2.5 - 2.5.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-09-20T17:29:00.337",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/94657",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20180629-0003/",
      "source": "security@apache.org"
    },
    {
      "url": "https://struts.apache.org/docs/s2-044.html",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/94657",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20180629-0003/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://struts.apache.org/docs/s2-044.html",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL."
    },
    {
      "lang": "es",
      "value": "En Apache Struts desde la versión 2.5 hasta la 2.5.5, si una aplicación permite la introducción de una URL en un campo de un formulario y se emplea URLValidator (integrado), es posible preparar una URL especial que será usada para sobrecargar el proceso del servidor cuando se lleva a cabo la validación de la URL."
    }
  ],
  "lastModified": "2026-06-17T00:54:55.010",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:struts:2.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63CE1226-E0E6-4DC6-AC89-3FFDE6BD7B77"
            },
            {
              "criteria": "cpe:2.3:a:apache:struts:2.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A4F914BA-CF16-4B03-A6A2-8C9816EC1248"
            },
            {
              "criteria": "cpe:2.3:a:apache:struts:2.5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D2C82970-62C9-4513-A66D-6BDA4048C27F"
            },
            {
              "criteria": "cpe:2.3:a:apache:struts:2.5.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E1A43CA5-46DE-4513-A309-BE3A60CD5489"
            },
            {
              "criteria": "cpe:2.3:a:apache:struts:2.5.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D83D2FA-8931-45F8-82D6-DE270A2BA55C"
            },
            {
              "criteria": "cpe:2.3:a:apache:struts:2.5.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D284BF2-101C-490C-85CB-69D156D1FF77"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}