CVE-2016-4003: Apache Struts

Medium severity, CVSS 6.1. EPSS: 11.6% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter.

Affected products

• Apache Struts: from 2.0.0, up to and including 2.3.24.1

Published 2016-04-12. Last modified 2026-06-17.