CRITICAL 9.8 Maven
Apache Struts vulnerable to path traversal
GHSA-2j39-qcjm-428w · CVE-2023-50164
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.
Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2023-50164
- WEB https://github.com/apache/struts/commit/162e29fee9136f4bfd9b2376da2cbf590f9ea163
- WEB https://github.com/apache/struts/commit/d8c69691ef1d15e76a5f4fcf33039316da2340b6
- WEB https://cwiki.apache.org/confluence/display/WW/S2-066
- PACKAGE https://github.com/apache/struts
- WEB https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj
- WEB https://security.netapp.com/advisory/ntap-20231214-0010
- WEB https://www.openwall.com/lists/oss-security/2023/12/07/1
- WEB http://packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.html
- WEB http://www.openwall.com/lists/oss-security/2023/12/07/1
Ready to move
Start Securing
Free, no credit card | First findings in minutes