VYPR
← All advisories
Medium severity5.9NVD Advisory· Published Sep 20, 2017· Updated Jun 17, 2026

CVE-2016-8738

CVE-2016-8738

Description

In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.struts:struts2-coreMaven
>= 2.5.0, < 2.5.132.5.13

Affected products

8
  • Apache/Struts7 versions
    cpe:2.3:a:apache:struts:2.5:*:*:*:*:*:*:*+ 6 more
    • cpe:2.3:a:apache:struts:2.5:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:struts:2.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:struts:2.5.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:struts:2.5.3:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:struts:2.5.4:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:struts:2.5.5:*:*:*:*:*:*:*
    • (no CPE)range: 2.5 - 2.5.5
  • ghsa-coords
    pkg:maven/org.apache.struts/struts2-core
    Range: >= 2.5.0, < 2.5.13

Patches

Vulnerability mechanics

References

7

News mentions

0

No linked articles in our index yet.