CVE-2016-4433

Apache Struts Open Redirect

7.5 HighFix available

CVE-2016-4433 is a high vulnerability (CVSS 7.5) in Apache Struts, published July 4, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.75%, the 95th percentile. Fixed in org.apache.struts.xwork:xwork-core 2.3.29.

Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

9.75%Up 3.5 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.

Record: CVE-2016-4433
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.

Record: CVE-2016-4433
Updated: 2026-11-02

EUVDEUVD-2022-5595 No score

Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.

Record: EUVD-2022-5595
Updated: 2026-11-03

GitHub AdvisoriesGHSA-wm8w-qp2f-728q 7.5

Apache Struts Open Redirect

Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.

Record: GHSA-wm8w-qp2f-728q
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-20
Updated: 2026-11-02

OSV 7.5

Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.

Record: CVE-2016-4433
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVGHSA-wm8w-qp2f-728q 7.5

Apache Struts Open Redirect

Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.

Record: GHSA-wm8w-qp2f-728q
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-20
Updated: 2026-11-02

Affected products

apache struts

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.struts.xwork:xwork-core` Maven	2.3.20 to 2.3.28.1	2.3.29
`org.apache.struts.xwork:xwork-core` Maven	2.3.20 up to 2.3.29, plus listed versions 2.3.20.12.3.20.32.3.242.3.24.12.3.24.32.3.282.3.28.1	2.3.29

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 7 moreShow less