← Retour aux CVEs

CVE-2023-50164

CRITICAL

9.8

Description

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie12/7/2023

Derniere modification2/13/2025

Sourcenvd

Observations honeypot0

Produits affectes

apache:struts

Faiblesses (CWE)

CWE-552

References

http://packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.html(security@apache.org)

https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj(security@apache.org)

https://security.netapp.com/advisory/ntap-20231214-0010/(security@apache.org)

https://www.openwall.com/lists/oss-security/2023/12/07/1(security@apache.org)

http://packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20231214-0010/(af854a3a-2127-422b-91ae-364da2661108)

https://www.openwall.com/lists/oss-security/2023/12/07/1(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.