CVE-2016-1181

Description

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.

8.1

CVSS

Severity: High

CVSS 3.0 •

CVSS 2.0 •

EPSS 9.18% Top 10%

Vendor Advisory jvn.jp Vendor Advisory jvn.jp

Affected: n/a n/a

References

Link	Tags
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000096	vdb entry third party advisory vendor advisory
http://www.securityfocus.com/bid/91068	vdb entry third party advisory
http://www.securitytracker.com/id/1036056	vdb entry third party advisory
http://jvn.jp/en/jp/JVN03188560/index.html	third party advisory vendor advisory
http://www.securityfocus.com/bid/91787	vdb entry third party advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html	patch
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html	patch
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html	patch
https://www.oracle.com/security-alerts/cpujul2020.html
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html	patch
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html	patch
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
https://www.oracle.com/security-alerts/cpujan2020.html
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html	third party advisory patch
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	patch
https://security.netapp.com/advisory/ntap-20180629-0006/	third party advisory
https://github.com/kawasima/struts1-forever/commit/eda3a79907ed8fcb0387a0496d0cb14332f250e8	issue tracking patch
https://bugzilla.redhat.com/show_bug.cgi?id=1343538	issue tracking
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html	third party advisory patch
https://security-tracker.debian.org/tracker/CVE-2016-1181	third party advisory

Frequently Asked Questions

What is the severity of CVE-2016-1181?: CVE-2016-1181 has been scored as a high severity vulnerability.
How to fix CVE-2016-1181?: To fix CVE-2016-1181, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2016-1181 being actively exploited in the wild?: It is possible that CVE-2016-1181 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~9% probability that this vulnerability will be exploited by malicious actors in the next 30 days.