Rule Category

SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.

Alert Message

SERVER-WEBAPP Apache Struts URL validator denial of service attempt

Rule Explanation

The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field. Impact: Web Application Attack CVSS base score 5.3 CVSS impact score 1.4 CVSS exploitability score 3.9 confidentialityImpact NONE integrityImpact NONE availabilityImpact NONE Details: Ease of Attack:

What To Look For

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

MITRE ATT&CK Framework

Tactic:

Technique:

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org

CVE

Additional Links

Rule Vulnerability

CVE Additional Information

CVE-2016-4465
The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.
Details
Severity Base Score5.3
Impact Score1.4 Exploit Score3.9
Confidentiality ImpactNONE Integrity ImpactNONE
Availability ImpactLOW Access Vector
Authentication Ease of Access