CVEvulnerability
CVE-2023-50164
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2023-12-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-552
Description
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.
Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
Affected configurations
• apache struts (>= 2.0.0 < 2.5.33)
• apache struts (>= 6.0.0 < 6.3.0.2)
Related
Weakness · CWE (1)
- CWE-552 Files or Directories Accessible to External Parties weakness
References
- http://packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.html Third Party Advisory, VDB Entry
- https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj Mailing List, Patch
- https://security.netapp.com/advisory/ntap-20231214-0010/ Third Party Advisory, VDB Entry
- https://www.openwall.com/lists/oss-security/2023/12/07/1 Mailing List
- http://packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.html Third Party Advisory, VDB Entry
- https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj Mailing List, Patch
- https://security.netapp.com/advisory/ntap-20231214-0010/ Third Party Advisory, VDB Entry
- https://www.openwall.com/lists/oss-security/2023/12/07/1 Mailing List