High
Security advisory
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-1182
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:04 UTC · Revision 1
Source evidence
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.
osv:CVE-2016-1182
Complete source record
{
"id": "895c443e304e7518836fed9e89241e69d2b4248704822e7e46611032577058af",
"url": "https://osv.dev/vulnerability/CVE-2016-1182",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-1182",
"summary": "ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.",
"evidence": "osv:CVE-2016-1182",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2016-1182",
"aliases": [
"CVE-2016-1182",
"GHSA-5ggr-mpgw-3mgx"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/struts1",
"type": "GIT",
"events": [
{
"introduced": "2f31da8d6315acf6f8e9bf44250345d1d9363f85"
},
{
"last_affected": "432ca08cb5f436f290ab3dcaa9267739cf8f6f89"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:struts:1.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0"
},
{
"last_affected": "1.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.0.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0.1"
},
{
"last_affected": "1.0.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.0.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0.2"
},
{
"last_affected": "1.0.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.1"
},
{
"last_affected": "1.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.1:b1:*:*:*:*:*:*",
"range": [
{
"introduced": "1.1-b1"
},
{
"last_affected": "1.1-b1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.1:b2:*:*:*:*:*:*",
"range": [
{
"introduced": "1.1-b2"
},
{
"last_affected": "1.1-b2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.1:b3:*:*:*:*:*:*",
"range": [
{
"introduced": "1.1-b3"
},
{
"last_affected": "1.1-b3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.1:rc1:*:*:*:*:*:*",
"range": [
{
"introduced": "1.1-rc1"
},
{
"last_affected": "1.1-rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.1:rc2:*:*:*:*:*:*",
"range": [
{
"introduced": "1.1-rc2"
},
{
"last_affected": "1.1-rc2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.2.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.2.0"
},
{
"last_affected": "1.2.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.2.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.2.1"
},
{
"last_affected": "1.2.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.2.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.2.2"
},
{
"last_affected": "1.2.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.2.3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.2.3"
},
{
"last_affected": "1.2.3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.2.4:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.2.4"
},
{
"last_affected": "1.2.4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.2.5:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.2.5"
},
{
"last_affected": "1.2.5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.2.6:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.2.6"
},
{
"last_affected": "1.2.6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.2.7:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.2.7"
},
{
"last_affected": "1.2.7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.2.8:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.2.8"
},
{
"last_affected": "1.2.8"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.2.9:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.2.9"
},
{
"last_affected": "1.2.9"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.3.5:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.3.5"
},
{
"last_affected": "1.3.5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.3.6:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.3.6"
},
{
"last_affected": "1.3.6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.3.7:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.3.7"
},
{
"last_affected": "1.3.7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.3.8:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.3.8"
},
{
"last_affected": "1.3.8"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.3.9:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.3.9"
},
{
"last_affected": "1.3.9"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:struts:1.3.10:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.3.10"
},
{
"last_affected": "1.3.10"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"1.0",
"1.0.1",
"1.0.2",
"1.1",
"1.1-b1",
"1.1-b2",
"1.1-b3",
"1.1-rc1",
"1.1-rc2",
"1.2.0",
"1.2.1",
"1.2.2",
"1.2.3",
"1.2.4",
"1.2.5",
"1.2.6",
"1.2.7",
"1.2.8",
"1.2.9",
"1.3.10",
"1.3.5",
"1.3.6",
"1.3.7",
"1.3.8",
"1.3.9"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-1182.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/kawasima/struts1-forever",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "eda3a79907ed8fcb0387a0496d0cb14332f250e8"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "eda3a79907ed8fcb0387a0496d0cb14332f250e8"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-1182.json",
"vanir_signatures": [
{
"id": "CVE-2016-1182-764707ed",
"digest": {
"threshold": 0.9,
"line_hashes": [
"105683631592247336656902944296599776314",
"40981726263095459424735472524808111251",
"2862303786404748042128178646467853349",
"207811457015275234257908205684295616493",
"277441258005566005519449599142878175700",
"312030805473486047810321879232524257574",
"282885639057810389179926927882785283503",
"204003968012705145478634013621690649237",
"304135678579568505631571992824951596339",
"243801532632016926960935286584807912263",
"217952086855472955496748280862806822199",
"305835152997505964804853882214061065472",
"229000502007580529303393046443959208742",
"30950044751233646112604525648435103748",
"259790258951861695249469713590068846770",
"233806469193145712396754822240236768822",
"135017837667307501811633680627790578472",
"257915629249777109357690232717200368499",
"72090433207419475626824692099586187379",
"99361996744071112323855774539141373025",
"149986068576086754127419569682222825213",
"136573233982601750858815088475377704808",
"78929048846053596461475036927463911723",
"258880862603859572277040310730946367789",
"308953546970365236756095253658591166631",
"78232233485352958434019412894233927009",
"48192962668982626538339483583244948777",
"64207166715813736093283923163539143977",
"276937143968145029020682005467026873783",
"83311304532829486008134214003320990549",
"230473023252087587097637910274006300896",
"309891649199857882751962721816820094800",
"77828087490743293410210199591691997086",
"253655484813366289844608959980497130922",
"163919496591251264925710851458967823163",
"207431811514667770692319474526457444558",
"96744140631647954610835818087371790242",
"127303369594388276279524254994130425455",
"203236370221193438834646047220884227858",
"263253822658907603002033271460854479663",
"58025557969618660640075213532826563098",
"244644852332381914097874412335171371959"
]
},
"source": "https://github.com/kawasima/struts1-forever/commit/eda3a79907ed8fcb0387a0496d0cb14332f250e8",
"target": {
"file": "src/share/org/apache/struts/action/ActionServlet.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-1182-9b3dfe6b",
"digest": {
"length": 1210,
"function_hash": "314656000574971036214094989453598472483"
},
"source": "https://github.com/kawasima/struts1-forever/commit/eda3a79907ed8fcb0387a0496d0cb14332f250e8",
"target": {
"file": "src/share/org/apache/struts/action/ActionServlet.java",
"function": "initOther"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:05:43Z"
}
}
],
"modified": "2026-10-24T14:05:43.173008803Z",
"provider": "osv",
"references": [
"https://www.oracle.com/security-alerts/cpujan2020.html",
"https://www.oracle.com/security-alerts/cpujul2020.html",
"https://security-tracker.debian.org/tracker/CVE-2016-1182",
"https://security.netapp.com/advisory/ntap-20180629-0006/",
"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
"https://bugzilla.redhat.com/show_bug.cgi?id=1343540",
"https://github.com/kawasima/struts1-forever/commit/eda3a79907ed8fcb0387a0496d0cb14332f250e8",
"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:apache:struts:1.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.0:beta1:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.0:beta2:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.0:beta3:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.1:b1:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.1:b2:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.1:b3:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.1:rc1:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.1:rc2:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.2.2:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.2.5:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.2.6:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.2.7:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.2.8:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.2.9:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.3.10:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.3.5:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.3.6:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.3.7:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.3.8:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:struts:1.3.9:*:*:*:*:*:*:*"
],
"vendor_product": "apache:struts",
"extracted_events": [
{
"range": [
{
"introduced": "1.0"
},
{
"last_affected": "1.0"
},
{
"introduced": "1.0-beta1"
},
{
"last_affected": "1.0-beta1"
},
{
"introduced": "1.0-beta1"
},
{
"last_affected": "1.0-beta1"
},
{
"introduced": "1.0-beta2"
},
{
"last_affected": "1.0-beta2"
},
{
"introduced": "1.0-beta2"
},
{
"last_affected": "1.0-beta2"
},
{
"introduced": "1.0-beta3"
},
{
"last_affected": "1.0-beta3"
},
{
"introduced": "1.0-beta3"
},
{
"last_affected": "1.0-beta3"
},
{
"introduced": "1.0.1"
},
{
"last_affected": "1.0.1"
},
{
"introduced": "1.0.2"
},
{
"last_affected": "1.0.2"
},
{
"introduced": "1.1"
},
{
"last_affected": "1.1"
},
{
"introduced": "1.1-b1"
},
{
"last_affected": "1.1-b1"
},
{
"introduced": "1.1-b2"
},
{
"last_affected": "1.1-b2"
},
{
"introduced": "1.1-b3"
},
{
"last_affected": "1.1-b3"
},
{
"introduced": "1.1-rc1"
},
{
"last_affected": "1.1-rc1"
},
{
"introduced": "1.1-rc2"
},
{
"last_affected": "1.1-rc2"
},
{
"introduced": "1.2.0"
},
{
"last_affected": "1.2.0"
},
{
"introduced": "1.2.1"
},
{
"last_affected": "1.2.1"
},
{
"introduced": "1.2.2"
},
{
"last_affected": "1.2.2"
},
{
"introduced": "1.2.3"
},
{
"last_affected": "1.2.3"
},
{
"introduced": "1.2.4"
},
{
"last_affected": "1.2.4"
},
{
"introduced": "1.2.5"
},
{
"last_affected": "1.2.5"
},
{
"introduced": "1.2.6"
},
{
"last_affected": "1.2.6"
},
{
"introduced": "1.2.7"
},
{
"last_affected": "1.2.7"
},
{
"introduced": "1.2.8"
},
{
"last_affected": "1.2.8"
},
{
"introduced": "1.2.9"
},
{
"last_affected": "1.2.9"
},
{
"introduced": "1.3.5"
},
{
"last_affected": "1.3.5"
},
{
"introduced": "1.3.6"
},
{
"last_affected": "1.3.6"
},
{
"introduced": "1.3.7"
},
{
"last_affected": "1.3.7"
},
{
"introduced": "1.3.8"
},
{
"last_affected": "1.3.8"
},
{
"introduced": "1.3.9"
},
{
"last_affected": "1.3.9"
},
{
"introduced": "1.3.10"
},
{
"last_affected": "1.3.10"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2016-1182",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443002,
"published_at": "2016-07-04T22:59:02.88+00:00"
}