En resumen
- CVE-2024-53677 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a org.apache.struts:struts2-core, struts (apache).
- Probabilidad de explotación en los próximos 30 días (EPSS): 72.4%, mayor que el 99.4% de las vulnerabilidades.
- Solución: actualizar a 6.4.0 o posterior.
Description
File upload logic is flawed vulnerability in Apache Struts. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.
This issue affects Apache Struts: from 2.0.0 before 6.4.0.
Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload. If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.
You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067 .
NVD description
File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.
This issue affects Apache Struts: from 2.0.0 before 6.4.0.
Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.
You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067
Más vulnerabilidades de org.apache.struts:struts2-core
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free