CVE-2016-4433: Apache Struts Open Redirect
Summary
CVE-2016-4433: Apache Struts Open Redirect. Affects org.apache.struts.xwork:xwork-core versions >= 2.3.20, < 2.3.29. Fixed in 2.3.29. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and a MVC (Model-View-Controller) architecture. The vulnerability identified as CVE-2016-4433 affects Apache Struts version 2.3.20 through 2.3.28.1. This vulnerability allows remote attackers to bypass intended access restrictions and conduct redirection attacks by exploiting a flaw in the framework's request handling mechanism.
Vulnerability Detail
The CVE-2016-4433 vulnerability in Apache Struts allows attackers to bypass access restrictions and perform open redirect attacks. By crafting a malicious request, an attacker can trick the application into redirecting users to arbitrary URLs. This can lead to various security risks, such as phishing attacks, session hijacking, and the disclosure of sensitive information. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 2.3.37 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.29
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, it is crucial to promptly update the Apache Struts framework to a patched version to eliminate the vulnerability.
Conclusion
The CVE-2016-4433 vulnerability in Apache Struts poses a significant security risk, allowing attackers to bypass access restrictions and perform open redirect attacks. To mitigate this vulnerability, it is crucial to promptly update the Apache Struts framework to a patched version. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.struts.xwork:xwork-core →
FAQ
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and follows the MVC (Model-View-Controller) architecture.
An open redirect vulnerability allows attackers to redirect users to arbitrary URLs. By exploiting this vulnerability, attackers can trick users into visiting malicious websites or disclosing sensitive information.
The CVE-2016-4433 vulnerability can lead to various security risks, including phishing attacks, session hijacking, and the disclosure of sensitive information.
To fix the CVE-2016-4433 vulnerability, it is recommended to upgrade the Apache Struts framework to a version beyond 2.3.28.1.
There is no specific workaround mentioned for this vulnerability. However, updating the Apache Struts framework to a patched version is essential to mitigate the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts.xwork:xwork-core.
