CVE-2016-2162: Apache Struts XSS Vulnerability in org.apache.struts:struts-master
Summary
CVE-2016-2162: Apache Struts XSS Vulnerability. Affects org.apache.struts:struts2-core versions >= 2.0.0, < 2.3.28. Fixed in 2.3.28. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and a MVC (Model-View-Controller) architecture for building scalable and maintainable web applications. The org.apache.struts:struts-master package is a core component of Apache Struts that handles internationalization (i18n) functionality. This vulnerability affects versions prior to 2.3.25.
Vulnerability Detail
The Apache Struts XSS vulnerability (CVE-2016-2162) arises from a lack of sanitization of text in the Locale object constructed by the I18NInterceptor. This allows remote attackers to exploit cross-site scripting (XSS) attacks through unspecified vectors involving language display. An attacker could inject malicious code into the application, which would then be executed in the context of the victim's browser. This can lead to various security risks, including unauthorized access to sensitive information, session hijacking, and the potential for further attacks.
How To Fix
Latest published version: 7.4.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.28
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, a temporary workaround can be implemented. This involves manually sanitizing the text in the Locale object before it is used for language display. The specific implementation details will depend on the application's codebase and usage of the Apache Struts framework. It is recommended to consult the official Apache Struts documentation and seek guidance from experienced developers or security professionals to ensure the correct implementation of the workaround.
Conclusion
The Apache Struts XSS vulnerability (CVE-2016-2162) in the org.apache.struts:struts-master package can lead to cross-site scripting (XSS) attacks and various security risks. It is crucial to promptly address this vulnerability by upgrading to version 2.3.25 or later of the package. If immediate upgrade is not possible, implement the recommended workaround and consult the official Apache Struts documentation for further guidance. For additional support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.struts:struts2-core →
FAQ
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and a MVC architecture for building scalable and maintainable web applications.
The org.apache.struts:struts-master package is a core component of Apache Struts that handles internationalization (i18n) functionality.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various security risks, including unauthorized access to sensitive information and the potential for further attacks.
This vulnerability can allow remote attackers to conduct cross-site scripting (XSS) attacks, which can lead to unauthorized access to sensitive information, session hijacking, and the potential for further attacks.
To fix this vulnerability, it is recommended to upgrade the org.apache.struts:struts-master package to version 2.3.25 or later. This version includes the necessary sanitization of text in the Locale object, preventing the XSS vulnerability. Update the package by modifying the dependency in the project's pom.xml file and rebuilding the application.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts2-core.
