com.github.a-pz:struts2-thymeleaf3-plugin (>=1.0.3-RELEASE <=1.0.5-RELEASE), com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (=2.5.1) +73 more potentially affected by CVE-2016-8738 via org.apache.struts:struts2-core (>=2.5.1 <=2.5.12)

org.apache.struts:struts2-core MAVEN version =2.5.1, =1.0.3-RELEASE, =0.9.4, =2.5.1, =2.5.1, =2.5.1, =2.5.1, =2.5.1, =2.5.1, =2.5.1, =2.5.1, =2.5.1, =2.5.1, =2.5.12 - org.apache.struts:struts2-java8-support-plugin =2.5.1 and more Source cves: CVE-2016-8738 Source advisory: OSV:GHSA-86VQ-8QHC-5RQW...

CVE-2016-8738

In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL...

CVE-2016-8738

CVE-2016-8738 affects Apache Struts 2.5 to 2.5.5. The issue arises when an application accepts a URL in a form field and uses the built-in URLValidator; a specially crafted URL can be used to overload the server during URL validation, yielding a DoS effect. The provided documents confirm the vuln...

Apache Struts 2.5.x < 2.5.13 URLValidator Form Field Handling Remote DoS (S2-044)

The version of Apache Struts running on the remote host is 2.5.x prior to 2.5.13. It is, therefore, affected by a denial of service vulnerability in the URLValidator class due to improper handling of user-supplied input to the form field. An unauthenticated, remote attacker can exploit this, via ...