ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Jul 4, 2016 · NIST NVD

   Detected

   ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.

2. Oct 15, 2026 · NIST NVD

   Updated

   ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.

Affected

• cpe apache/struts1.0
• cpe oracle/banking platform2.3.0
• cpe oracle/banking platform2.4.0
• cpe oracle/banking platform2.4.1
• cpe oracle/banking platform2.5.0
• cpe oracle/portal11.1.1.6

Sources

• CVE.orgVulnerability recordCVE-2016-1181

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2016-1181

  ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015

  nvd.nist.gov

References

• Vendor Advisory · jvn.jp
• Third Party Advisory · jvndb.jvn.jp
• Patch · oracle.com
• Patch · oracle.com
• Patch · oracle.com
• Patch · oracle.com
• Patch · oracle.com
• Patch · oracle.com