Описание
File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.
This issue affects Apache Struts: from 2.0.0 before 6.4.0.
Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.
You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067
A flaw was found in Apache Struts. Affected versions of this package are vulnerable to remote code execution (RCE) via manipulation of the file upload mechanism that enables path traversal. Under certain conditions, uploading a malicious file is possible and may then be executed on the server.
Отчет
No Red Hat products are affected by this vulnerability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| A-MQ Clients 2 | org.apache.struts/struts-core | Not affected | ||
| A-MQ Clients 2 | org.apache.struts/struts-taglib | Not affected | ||
| A-MQ Clients 2 | org.apache.struts/struts-tiles | Not affected | ||
| Red Hat AMQ Broker 7 | org.apache.struts/struts-core | Not affected | ||
| Red Hat AMQ Broker 7 | org.apache.struts/struts-taglib | Not affected | ||
| Red Hat AMQ Broker 7 | org.apache.struts/struts-tiles | Not affected | ||
| Red Hat build of Apache Camel for Spring Boot 4 | org.apache.struts/struts-core | Not affected | ||
| Red Hat build of Apache Camel for Spring Boot 4 | org.apache.struts/struts-taglib | Not affected | ||
| Red Hat build of Apache Camel for Spring Boot 4 | org.apache.struts/struts-tiles | Not affected | ||
| Red Hat build of Debezium 2 | org.apache.struts/struts-core | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
9 Critical
CVSS3
Связанные уязвимости
File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe. You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067
Уязвимость механизма File Upload программной платформы Apache Struts, позволяющая нарушителю выполнить произвольный код
EPSS
9 Critical
CVSS3