CVE-2016-1181

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2016-1181
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-1181.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2016-1181
Aliases
Related
Published
2016-07-04T22:59:01.617Z
Modified
2025-11-27T20:42:44.433291Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.

References

Affected packages

Git / github.com/apache/struts1

Affected ranges

Type
GIT
Repo
https://github.com/apache/struts1
Events
Introduced
0 Unknown introduced commit / All previous commits are affected

Git / github.com/kawasima/struts1-forever

Affected ranges

Type
GIT
Repo
https://github.com/kawasima/struts1-forever
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
eda3a79907ed8fcb0387a0496d0cb14332f250e8

Database specific

vanir_signatures

[
    {
        "signature_type": "Line",
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "105683631592247336656902944296599776314",
                "40981726263095459424735472524808111251",
                "2862303786404748042128178646467853349",
                "207811457015275234257908205684295616493",
                "277441258005566005519449599142878175700",
                "312030805473486047810321879232524257574",
                "282885639057810389179926927882785283503",
                "204003968012705145478634013621690649237",
                "304135678579568505631571992824951596339",
                "243801532632016926960935286584807912263",
                "217952086855472955496748280862806822199",
                "305835152997505964804853882214061065472",
                "229000502007580529303393046443959208742",
                "30950044751233646112604525648435103748",
                "259790258951861695249469713590068846770",
                "233806469193145712396754822240236768822",
                "135017837667307501811633680627790578472",
                "257915629249777109357690232717200368499",
                "72090433207419475626824692099586187379",
                "99361996744071112323855774539141373025",
                "149986068576086754127419569682222825213",
                "136573233982601750858815088475377704808",
                "78929048846053596461475036927463911723",
                "258880862603859572277040310730946367789",
                "308953546970365236756095253658591166631",
                "78232233485352958434019412894233927009",
                "48192962668982626538339483583244948777",
                "64207166715813736093283923163539143977",
                "276937143968145029020682005467026873783",
                "83311304532829486008134214003320990549",
                "230473023252087587097637910274006300896",
                "309891649199857882751962721816820094800",
                "77828087490743293410210199591691997086",
                "253655484813366289844608959980497130922",
                "163919496591251264925710851458967823163",
                "207431811514667770692319474526457444558",
                "96744140631647954610835818087371790242",
                "127303369594388276279524254994130425455",
                "203236370221193438834646047220884227858",
                "263253822658907603002033271460854479663",
                "58025557969618660640075213532826563098",
                "244644852332381914097874412335171371959"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2016-1181-764707ed",
        "target": {
            "file": "src/share/org/apache/struts/action/ActionServlet.java"
        },
        "source": "https://github.com/kawasima/struts1-forever/commit/eda3a79907ed8fcb0387a0496d0cb14332f250e8"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "length": 1210.0,
            "function_hash": "314656000574971036214094989453598472483"
        },
        "id": "CVE-2016-1181-9b3dfe6b",
        "target": {
            "function": "initOther",
            "file": "src/share/org/apache/struts/action/ActionServlet.java"
        },
        "source": "https://github.com/kawasima/struts1-forever/commit/eda3a79907ed8fcb0387a0496d0cb14332f250e8"
    }
]