CVE-2016-8738

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Struts	2.5 - 2.5.5

References

http://www.securityfocus.com/bid/94657Third Party Advisory, VDB Entry
https://security.netapp.com/advisory/ntap-20180629-0003/
https://struts.apache.org/docs/s2-044.htmlMitigation, Patch, Vendor Advisory
http://www.securityfocus.com/bid/94657Third Party Advisory, VDB Entry
https://security.netapp.com/advisory/ntap-20180629-0003/
https://struts.apache.org/docs/s2-044.htmlMitigation, Patch, Vendor Advisory

Timeline

Published: Sep 20, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-87397.5The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers CVE-2016-87407.5The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict CVE-2016-87417.5The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among th CVE-2016-87427.8The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation. All files in the install inherit t CVE-2016-87437.5Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response li CVE-2016-87448.8Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should CVE-2016-87457.5A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.R CVE-2016-87465.9Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recu CVE-2016-87477.5An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. H CVE-2016-87485.4In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed CVE-2016-87499.8Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.CVE-2016-87506.5Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames p