CVE-2016-4003

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 11.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-04-12 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter.

Affected products

Apache Struts: from 2.0.0 through 2.3.24.1

References

http://struts.apache.org/docs/s2-028.html
http://www.securityfocus.com/bid/86311
http://www.securitytracker.com/id/1035268
https://issues.apache.org/jira/browse/WW-4507
http://struts.apache.org/docs/s2-028.html
http://www.securityfocus.com/bid/86311
http://www.securitytracker.com/id/1035268
https://issues.apache.org/jira/browse/WW-4507

Get alerted when CVE-2016-4003 or the next vulnerability affects your stack