CVE-2016-2162

MEDIUM

Apache Struts < 2.3.28 - XSS

Title source: rule

Description

Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display.

References (3)

[Vendor Advisory] http://struts.apache.org/docs/s2-030.html

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1035272

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/85070

Scores

CVSS v3 6.1

EPSS 0.0141

EPSS Percentile 80.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

CWE

CWE-79

Status draft

Affected Products (50)

apache/struts

... and 35 more

Timeline

Published Apr 12, 2016

Tracked Since Feb 18, 2026