CVE-2016-4003

Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte…

published April 12, 2016

CVSS

—

EPSS

12%

Percentile

96.0

In the wild

Unconfirmed

What it is

Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.11562 · 96.0th percentile
Published: 2016-04-12T16:00Z

EPSS history

Timeline

12 APR 16:00Z
Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte…
cvelistv5