ゆんぼう@yun_bow
Apache Struts 1とは？2013年のEOLとCVE-2016-1181から考える移行判断 | OSS探訪 https://oss-tanbou.dev/ja/articles/apache-struts1-eol-cve-2016-1181
0001092
180 followersView on X
CVE-2016-1181(apache / banking_platform)
LOWCVSS 8.1 · HIGHSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.
0.5/ 10 priority
Sources & remediation
Patch / fix
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
Vendor / third-party advisories
Other references
- https://bugzilla.redhat.com/show_bug.cgi?id=1343538
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
Are you affected?
If you run products in this scope, you should treat this CVE as relevant to your environment.
- banking_platform
- portal
- struts
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day
Affected systems
Products
banking_platformportalstruts
25 versions affected across 3 products
Deep dive
Activity timeline1 mentions / 1d
Referenced assets1 URL
Full discourse1 post
CPE platform detail33 entries
33 of 33 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | apache | struts | 1.0 | - | - |
| App | apache | struts | 1.0 | - | - |
| App | apache | struts | 1.0 | - | - |
| App | apache | struts | 1.0 | - | - |
| App | apache | struts | 1.0.1 | - | - |
| App | apache | struts | 1.0.2 | - | - |
| App | apache | struts | 1.1 | - | - |
| App | apache | struts | 1.1 | - | - |
| App | apache | struts | 1.1 | - | - |
| App | apache | struts | 1.1 | - | - |
| App | apache | struts | 1.1 | - | - |
| App | apache | struts | 1.1 | - | - |
| App | apache | struts | 1.2.0 | - | - |
| App | apache | struts | 1.2.1 | - | - |
| App | apache | struts | 1.2.2 | - | - |
| App | apache | struts | 1.2.3 | - | - |
| App | apache | struts | 1.2.4 | - | - |
| App | apache | struts | 1.2.5 | - | - |
| App | apache | struts | 1.2.6 | - | - |
| App | apache | struts | 1.2.7 | - | - |
| App | apache | struts | 1.2.8 | - | - |
| App | apache | struts | 1.2.9 | - | - |
| App | apache | struts | 1.3.10 | - | - |
| App | apache | struts | 1.3.5 | - | - |
| App | apache | struts | 1.3.6 | - | - |
| App | apache | struts | 1.3.7 | - | - |
| App | apache | struts | 1.3.8 | - | - |
| App | apache | struts | 1.3.9 | - | - |
| App | oracle | banking_platform | 2.3.0 | - | - |
| App | oracle | banking_platform | 2.4.0 | - | - |
| App | oracle | banking_platform | 2.4.1 | - | - |
| App | oracle | banking_platform | 2.5.0 | - | - |
| App | oracle | portal | 11.1.1.6 | - | - |