CVE-2016-8738
Quick assessment
Affected
Apache Software Foundation Apache Struts
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Struts是美国阿帕奇（Apache）软件基金会负责维护的一个开源项目，是一套用于创建企业级Java Web应用的开源MVC框架，主要提供两个版本框架产品，Struts 1和Struts 2。Apache Struts 2是Apache Struts的下一代产品，是在Struts 1和WebWork的技术基础上进行了合并的全新Struts 2框架，其体系结构与Struts 1差别较大。 Apache Struts 2.5至2.5.5版本中存在拒绝服务漏洞。远程攻击者可借助特制的URL利用该
Possible ATT&CK Techniques 3 AI
T1087 · Account Discovery T1499 · Endpoint Denial of Service T1027 · Obfuscated Files or Information
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2016-8738
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Struts 2 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Struts是美国阿帕奇（Apache）软件基金会负责维护的一个开源项目，是一套用于创建企业级Java Web应用的开源MVC框架，主要提供两个版本框架产品，Struts 1和Struts 2。Apache Struts 2是Apache Struts的下一代产品，是在Struts 1和WebWork的技术基础上进行了合并的全新Struts 2框架，其体系结构与Struts 1差别较大。 Apache Struts 2.5至2.5.5版本中存在拒绝服务漏洞。远程攻击者可借助特制的URL利用该
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Struts | 2.5 - 2.5.5 | - |
|
II. Public POCs for CVE-2016-8738
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2016-8738
请登录查看更多情报信息。
Vendor Advisories for CVE-2016-8738 (2)
-
https://security.netapp.com/advisory/ntap-20180629-0003/ x_refsource_CONFIRM
-
Other References for CVE-2016-8738 (1)
-
https://struts.apache.org/docs/s2-044.html x_refsource_CONFIRM
Same Patch Batch · Apache Software Foundation · 2017-09-20 · 5 CVEs total
| CVE-2016-6795 | Apache Struts 路径遍历漏洞 | |
| CVE-2017-12611 | Apache Struts 输入验证错误漏洞 | |
| CVE-2017-9793 | Apache Struts 输入验证错误漏洞 | |
| CVE-2017-9804 | Apache Struts 2 安全漏洞 |
IV. Related Vulnerabilities
Same product: Apache Struts
-
CVE-2026-73632
Apache Struts: Shared serialization state in the JSON plugin -
CVE-2026-73631
Apache Struts: Shared parsing state in the JSON plugin -
CVE-2026-73635
Apache Struts: Unbounded growth of localized-text caches dri -
CVE-2026-73634
Apache Struts: Unbounded read of a Content Security Policy v -
CVE-2026-73633
Apache Struts: Unbounded read of a JSON request body
Same vendor: Apache Software Foundation
-
CVE-2026-75157
Apache Airflow: Asset queued-events DELETE endpoints gated o -
CVE-2026-92230
Apache Karaf: Improper release of ClassLoader references via -
CVE-2026-70469
Apache NiFi: Improper Handling of Case Sensitivity for Conte -
CVE-2026-81866
Apache NiFi: Missing Authorization for Assets and Secrets Re -
CVE-2026-82561
Apache NiFi: Missing Authorization for Components Referenced
V. Comments for CVE-2016-8738
No comments yet