VYPR
← All advisories
High severity7.5NVD Advisory· Published Jul 4, 2016· Updated May 6, 2026

CVE-2016-4431

CVE-2016-4431

Description

Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.struts:struts-parentMaven
>= 2.3.20, < 2.3.292.3.29

Patches

1
eccc31ebce54

Improves validation RegEx

https://github.com/apache/strutsLukasz LenartJun 14, 2016via ghsa
commit
2 files changed · +2 −1
  • xwork-core/src/main/java/com/opensymphony/xwork2/validator/validators/URLValidator.java+1 −1 modified
    @@ -82,7 +82,7 @@ public String getUrlRegex() {
                     "|((\\d|[1-9]\\d|1\\d{2}|2[0-4][0-9]|25[0-5])\\.){3}" +
                     "(\\d|[1-9]\\d|1\\d{2}|2[0-4][0-9]|25[0-5])" +
                     ")(:\\d+)?" +
-                    ")(((\\/+([a-z0-9$_\\.\\+!\\*\\'\\(\\),;:@&=-]|%[0-9a-f]{2})*)*" +
+                    ")(((\\/{0,1}([a-z0-9$_\\.\\+!\\*\\'\\(\\),;:@&=-]|%[0-9a-f]{2})*)*" +
                     "(\\?([a-z0-9$_\\.\\+!\\*\\'\\(\\),;:@&=-]|%[0-9a-f]{2})*)" +
                     "?)?)?" +
                     "(#([a-z0-9$_\\.\\+!\\*\\'\\(\\),;:@&=-]|%[0-9a-f]{2})*)?" +
  • xwork-core/src/test/java/com/opensymphony/xwork2/validator/URLValidatorTest.java+1 −0 modified
    @@ -139,6 +139,7 @@ public void testValidUrlWithDefaultRegex() throws Exception {
         assertFalse(pattern.matcher("").matches());
         assertFalse(pattern.matcher("   ").matches());
         assertFalse(pattern.matcher("no url").matches());
+		assertFalse(pattern.matcher("http://example.com////////////////////////////////////////////////////////////////////////////////////??").matches());
 
         assertTrue(pattern.matcher("http://www.opensymphony.com").matches());
         assertTrue(pattern.matcher("https://www.opensymphony.com").matches());

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

12

News mentions

0

No linked articles in our index yet.