Apache Struts CVE-2016-2162 Cross Site Scripting Vulnerability

Description

The Apache Struts framework usesI18NInterceptorto allow users and developers switch language used in the framework and an application built on top of it. The problem is that the interceptor doesn't perform any validation of the user input and accept arbitrary string which can be used by a developer to display language selected by the user. However, the framework doesn't expose the value directly in UI.

Affected Applications

Apache Struts

CVE References

Other References