Apache Struts Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.struts:struts2-core | ≥ 2.0.4, < 2.3.35≥ 2.5, < 2.5.17 | 2.3.352.5.17 |
| struts | ≥ 2.0.4, < 2.3.35≥ 2.5.0, < 2.5.17 | 2.3.352.5.17 |
| active iq unified manager | ≥ 7.3≥ 9.5 | |
| communications policy management | < 12.5.0 | 12.5.0 |
| enterprise manager base platform | = 13.3.0.0= 13.4.0.0 | |
| mysql enterprise monitor | ≥ 4.0.0, ≤ 4.0.6.5281≥ 8.0.0, ≤ 8.0.2.8191≤ 3.4.9.4237 |
Apache Struts contains a Remote Code Execution when using results with no namespace and it's upper actions have no or wildcard namespace. The same flaw exists when using a url tag with no value, action set, and it's upper actions have no or wildcard namespace.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free