← Volver a CVEs

CVE-2023-50164

CRITICAL

9.8

Descripcion

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Detalles CVE

Puntuacion CVSS v3.19.8

SeveridadCRITICAL

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado12/7/2023

Ultima modificacion2/13/2025

Fuentenvd

Avistamientos honeypot0

Productos afectados

apache:struts

Debilidades (CWE)

CWE-552

Referencias

http://packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.html(security@apache.org)

https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj(security@apache.org)

https://security.netapp.com/advisory/ntap-20231214-0010/(security@apache.org)

https://www.openwall.com/lists/oss-security/2023/12/07/1(security@apache.org)

http://packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20231214-0010/(af854a3a-2127-422b-91ae-364da2661108)

https://www.openwall.com/lists/oss-security/2023/12/07/1(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.