Every CVE Search/ Get API key

CVE-2016-1182

Improper Input Validation in Apache Struts

8.2 High

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
High

Exploit likelihood

25.7%Up 10.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 8.2

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

Record
CVE-2016-1182
CVSS 3.0
8.2 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS 2.0
6.4 MediumAV:N/AC:L/Au:N/C:N/I:P/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

Record
CVE-2016-1182
Updated
2026-11-02
EUVDEUVD-2022-2581 No score

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

Record
EUVD-2022-2581
Updated
2026-11-02
GitHub AdvisoriesGHSA-5ggr-mpgw-3mgx 8.2

Improper Input Validation in Apache Struts

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

Record
GHSA-5ggr-mpgw-3mgx
CVSS 3.0
8.2 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Weakness
CWE-20
Updated
2026-11-02
OSV 8.2

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

Record
CVE-2016-1182
CVSS 3.0
8.2 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVGHSA-5ggr-mpgw-3mgx 8.2

Improper Input Validation in Apache Struts

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

Record
GHSA-5ggr-mpgw-3mgx
CVSS 3.0
8.2 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Weakness
CWE-20
Updated
2026-11-02
OSVCLSA-2025-1754006692 No score

TuxCare security update for org.apache.struts (5 CVEs)

TuxCare rebuilt 2 org.apache.struts packages to address 5 CVEs. Fixed in 1.3.5-tuxcare.1.

Record
CLSA-2025-1754006692
Updated
2026-11-02
OSVCLSA-2026-1788410329 No score

TuxCare security update for org.springframework.graphql:spring-graphql (6 CVEs)

TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.3.5-tuxcare.1.

Record
CLSA-2026-1788410329
Updated
2026-11-02
OSVMGASA-2016-0244 No score

Updated struts packages fix security vulnerabilities

Updated struts packages fix security vulnerabilities:

A vulnerability in Apache Struts 1 ActionForm allowing unintended remote operations against components on server memory, such as Servlets and ClassLoader, was found (CVE-2016-1181).

It was reported that The Apache Struts 1 Validator contains a vulnerability where input validation configurations (validation rules, error messages, etc.) may be modified. This occurs when ValidatorForm and ValidatorActionForm (including its subclasses) are in the session scope (CVE-2016-1182).

Record
MGASA-2016-0244
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.struts:struts-core
Maven
 through 1.3.10 None known
struts:struts
Maven
 through 1.2.9 None known
org.apache.struts:struts-core
TuxCare:Maven
From an advisory covering 5 CVEs
 1.3.5 up to 1.3.5-tuxcare.1
1.3.5-tuxcare.1
org.apache.struts:struts-extras
TuxCare:Maven
From an advisory covering 5 CVEs
 1.3.5 up to 1.3.5-tuxcare.1
1.3.5-tuxcare.1
org.apache.struts:struts-core
Maven
 through 1.3.10, plus listed versions
1.3.51.3.81.3.9
 None known
struts:struts
Maven
 through 1.2.9, plus listed versions
1.0.21.11.1-b2-200211241.1-b31.1-beta-2
Show 6 moreShow less
1.1-rc11.1-rc21.2.21.2.41.2.71.2.8
 None known
struts
Mageia:5
From an advisory covering 2 CVEs
 before 1.3.10-8.2.mga5
1.3.10-8.2.mga5

History

History
RecordedChangedSources
affected, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-1182 is a high vulnerability (CVSS 8.2) in Apache Struts, published July 4, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 25.7%, the 97th percentile. No source names a fixed version.

References

Show 21 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open