Bugzilla – Bug 983684
VUL-0: CVE-2016-1182: struts: Improper input validation in Validator
Last modified: 2016-07-01 14:27:53 UTC
via rh bugzilla t was reported that The Apache Struts 1 Validator contains a vulnerability where input validation configurations (validation rules, error messages, etc.) may be modified. This occurs when ValidatorForm and ValidatorActionForm (including its subclasses) are in the session scope. Affects Apache Struts 1 versions 1.0 through 1.3.10. External References: https://jvn.jp/en/jp/JVN65044642/ JVN#65044642 Apache Struts 1 vulnerable to input validation bypass Overview The Apache Struts 1 Validator contains a vulnerability where input validation is bypassed. Products Affected Apache Struts 1 versions 1.0 through 1.3.10 Description The Apache Struts 1 Validator contains a vulnerability where input validation configurations (validation rules, error messages, etc.) may be modified. This occurs when the following ActionForm (including its subclasses) are in the session scope. ValidatorForm ValidatorActionForm Impact Effects vary depending on the web application. For example, cross-site scripting attacks or denial-of-service (DoS) attacks may be possible.
bugbot adjusting priority
Created attachment 682822 [details] struts-1.3.10-CVE-2016-1181-CVE-2016-1182.patch fedora patch
struts is only supported as part of the SUSE Manager product. The only package using struts it there is spacewalk-java. The shipped versions of spacewalk-java do not use the problematic code. Package itself is affected, but not our usage of it. Not requesting an update.