Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache
    Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject
    arbitrary web script or HTML via multi-byte characters in a url-encoded parameter. (CVE-2016-4003)

The version of Apache Struts running on the remote host is 2.x prior to 2.3.28. It is, therefore, affected by the following vulnerabilities :
  - A cross-site scripting vulnerability exists due to     improper validation of user-supplied input when using     a single byte page encoding. A remote attacker can     exploit this, via non-spec URL-encoded parameter value     including multi-byte characters. (CVE-2016-4003)

  - A remote code execution vulnerability exists due to     double OGNL evaluation of attribute values assigned to     certain tags. An unauthenticated, remote attacker can     exploit this, via a specially crafted request, to     execute arbitrary code. (CVE-2016-0785)

  - A cross-site scripting vulnerability exists due to     improper validation of user-supplied input when using     the I18NInterceptor. A remote attacker can exploit this,     via a specially crafted request, to execute arbitrary     script code in a user's browser session. (CVE-2016-2162)

  - A denial of service vulnerability exists in the     Object-Graph Navigation Language (OGNL) component due to     a flaw in the implementation of the cache for stored     method references. A context-dependent attacker can     exploit this to block access to arbitrary websites.
    (CVE-2016-3093)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
416699	SCA: security update for org.apache.struts:struts2-core (GHSA-m3x6-9v6h-4g28)	Tenable Cloud Security	SCA Checks	Local	medium
416699	SCA: security update for org.apache.struts:struts2-core (GHSA-m3x6-9v6h-4g28)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
90153	Apache Struts 2.x < 2.3.28 Multiple Vulnerabilities (S2-028) (S2-029) (S2-030) (S2-034)	Nessus	Misc.	Combined	high

Detections

Analytics

CVE-2016-4003

medium

Tenable Plugins

medium

medium

high