← Voltar para CVEs

CVE-2023-50164

CRITICAL

9.8

Descricao

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Detalhes CVE

Pontuacao CVSS v3.19.8

SeveridadeCRITICAL

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado12/7/2023

Ultima modificacao2/13/2025

Fontenvd

Avistamentos honeypot0

Produtos afetados

apache:struts

Fraquezas (CWE)

CWE-552

Referencias

http://packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.html(security@apache.org)

https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj(security@apache.org)

https://security.netapp.com/advisory/ntap-20231214-0010/(security@apache.org)

https://www.openwall.com/lists/oss-security/2023/12/07/1(security@apache.org)

http://packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20231214-0010/(af854a3a-2127-422b-91ae-364da2661108)

https://www.openwall.com/lists/oss-security/2023/12/07/1(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.