by Kastro
Paper/Archive/CVE-2023-50164

CVE-2023-50164

Apache Software Foundation Apache Struts — Apache Struts: File upload component had a directory traversal vulnerability

EPSS 81%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.6.996 × 2019.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Affected

ProductAffectedFixed inSource
Apache Struts2.0.0 – 2.5.32–CNA
Apache Struts6.0.0 – 6.3.0.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

advisorylists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhjrefopenwall.com/lists/oss-security/2023/12/07/1refpacketstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.htmlrefsecurity.netapp.com/advisory/ntap-20231214-0010