Apache Struts Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.
| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.struts:struts2-core | ≥ 2.3.0, < 2.3.32≥ 2.5.0, < 2.5.10.1 | 2.3.322.5.10.1 |
| struts | ≥ 2.2.3, < 2.3.32≥ 2.5.0, < 2.5.10.1 | 2.3.322.5.10.1 |
| clearpass policy manager | < 6.6.5 | 6.6.5 |
| server automation | = 10.0.0= 10.1.0= 10.2.0= 10.5.0= 9.1.0 | |
| weblogic server | = 10.3.6.0.0= 12.1.3.0.0= 12.2.1.1.0= 12.2.1.2.0 |
Apache Struts versions prior to 2.3.32 and 2.5.10.1 contain incorrect exception handling and error-message generation during file-upload attempts using the Jakarta Multipart parser, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free