CVE-2016-1182: Apache Struts

High severity, CVSS 8.2. EPSS: 25.7% chance of exploitation in the next 30 days.

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

Affected products

• Apache Struts: version 1.0 only; version 1.0.1 only; version 1.0.2 only; version 1.1 only; version 1.2.0 only; version 1.2.1 only; …

Published 2016-07-04. Last modified 2026-06-17.