com.amashchenko.struts2.pdfstream:struts2-pdfstream-plugin (2.0.0), com.amashchenko.struts2.pdfstream:struts2-pdfstream-showcase (2.0.0) +94 more potentially affected by CVE-2016-8738 via org.apache.struts:struts2-core (>=2.5, <=2.5.12)

org.apache.struts:struts2-core MAVEN version =2.5, =1.0.0-release, =2.5.0, =2.5.0, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.2 and more Source cves: CVE-2016-8738 Source advisory: OSV:GHSA-86VQ-8QHC-5RQWht...

com.amashchenko.struts2.pdfstream:struts2-pdfstream-plugin (2.0.0), com.amashchenko.struts2.pdfstream:struts2-pdfstream-showcase (2.0.0) +94 more potentially affected by CVE-2016-8738 via org.apache.struts:struts2-core (>=2.5, <=2.5.12)

org.apache.struts:struts2-core MAVEN version =2.5, =1.0.0-release, =2.5.0, =2.5.0, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.2 and more Source cves: CVE-2016-8738 Source advisory: GHSA-86VQ-8QHC-5RQWhttps:...

CVE-2016-8738

In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL...

com.amashchenko.struts2.pdfstream:struts2-pdfstream-plugin (2.0.0), com.amashchenko.struts2.pdfstream:struts2-pdfstream-showcase (2.0.0) +94 more potentially affected by CVE-2016-8738 via org.apache.struts:struts2-core (>=2.5, <=2.5.12)

org.apache.struts:struts2-core MAVEN version =2.5, =1.0.0-release, =2.5.0, =2.5.0, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.2 and more Source cves: CVE-2016-8738 Source advisory: MEND:CVE-2016-8738https:/...

CVE-2016-8738

CVE-2016-8738 affects Apache Struts 2.5 to 2.5.5. The issue arises when an application accepts a URL in a form field and uses the built-in URLValidator; a specially crafted URL can be used to overload the server during URL validation, yielding a DoS effect. The provided documents confirm the vuln...

Apache Struts 2.5.x < 2.5.13 URLValidator Form Field Handling Remote DoS (S2-044)

The version of Apache Struts running on the remote host is 2.5.x prior to 2.5.13. It is, therefore, affected by a denial of service vulnerability in the URLValidator class due to improper handling of user-supplied input to the form field. An unauthenticated, remote attacker can exploit this, via ...