ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site sc…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Jul 4, 2016 · NIST NVD

   Detected

   ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

2. Oct 15, 2026 · NIST NVD

   Updated

   ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

Affected

• cpe apache/struts1.0
• cpe apache/struts1.0.1
• cpe apache/struts1.0.2
• cpe apache/struts1.1

Sources

• CVE.orgVulnerability recordCVE-2016-1182

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2016-1182

  ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

  nvd.nist.gov

References

• Vendor Advisory · jvn.jp
• Third Party Advisory · jvndb.jvn.jp
• Patch · oracle.com
• Patch · oracle.com
• Patch · oracle.com
• Patch · oracle.com
• Patch · oracle.com
• Patch · oracle.com