CVE-2016-1181 (High) detected in struts-1.2.8.jar

[mend-bolt-for-github]

CVE-2016-1181 - High Severity Vulnerability

Vulnerable Library - struts-1.2.8.jar

The core of the Struts framework is a flexible control layer based on standard technologies like Java Servlets, JavaBeans, ResourceBundles, and Extensible Markup Language (XML), as well as various Jakarta Commons packages. Struts encourages application architectures based on the Model 2 approach, a variation of the classic Model-View-Controller (MVC) design paradigm. Struts provides its own Controller component and integrates with other technologies to provide the Model and the View. For the Model, Struts can interact with any standard data access technology, including Enterprise Java Beans, JDBC, and Object Relational Bridge. For the View, Struts works well with JavaServer Pages, including JSTL and JSF, as well as Velocity Templates, XSLT, and other presentation systems. The Struts framework provides the invisible underpinnings every professional web application needs to survive. Struts helps you create an extensible development environment for your application, based on published standards and proven design patterns.

Library home page: http://struts.apache.org/

Path to vulnerable library: /Remediate/WebGoat5.0/WebContent/WEB-INF/lib/struts.jar

Dependency Hierarchy:

• ❌ struts-1.2.8.jar (Vulnerable Library)

Vulnerability Details

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.

Publish Date: 2016-07-04

URL: CVE-2016-1181

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: kawasima/struts1-forever@eda3a79

Release Date: 2016-06-08

Fix Resolution: Replace or update the following file: ActionServlet.java

---

Step up your Open Source Security Game with WhiteSource here