Vulnerability Details : CVE-2016-8738
In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.
Vulnerability category: Input validation
Products affected by CVE-2016-8738
- cpe:2.3:a:apache:struts:2.5:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.5.2:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-8738
0.78%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 79 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-8738
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:N/A:P |
8.6
|
2.9
|
NIST | |
|
5.9
|
MEDIUM | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
2.2
|
3.6
|
NIST |
CWE ids for CVE-2016-8738
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-8738
-
https://security.netapp.com/advisory/ntap-20180629-0003/
October 2017 Apache Struts Vulnerabilities in NetApp Products | NetApp Product Security
-
http://www.securityfocus.com/bid/94657
Apache Struts CVE-2016-8738 Denial of Service VulnerabilityThird Party Advisory;VDB Entry
-
https://struts.apache.org/docs/s2-044.html
S2-044 - DEPRECATED: Apache Struts 2 Documentation - Apache Software FoundationMitigation;Patch;Vendor Advisory
Jump to