Vulnerability GHSA-2j39-qcjm-428w
Critical
CRITICAL RISK
CVSS Score: 9.8
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
2 years ago
December 07, 2023 at 09:30 AM UTC
Apache Struts vulnerable to path traversal
2.0.5 - 2.5.32 and 6.0.0 - 6.3.0.1
2.0.5 - 2.5.32 and 6.0.0 - 6.3.0.1
Summary
Apache Struts vulnerable to path traversal
Details
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
9 months ago
Apache Struts 2 is Missing XML Validation
2.0.5 - 2.3.37 and 2.5 - 6.0.3 GHSA-qcfc-hmrc-59x7
2.0.5 - 2.3.37 and 2.5 - 6.0.3 GHSA-qcfc-hmrc-59x7
High Risk
10 months ago
Apache Struts has a Denial of Service vulnerability
2.0.5 - 6.7.4 and 7.0.0 - 7.0.3 GHSA-rg58-xhh7-mqjw
2.0.5 - 6.7.4 and 7.0.0 - 7.0.3 GHSA-rg58-xhh7-mqjw
High Risk
10 months ago
Apache Struts is Vulnerable to DoS via File Leak
2.0.5 - 2.3.37 and 2.5 - 6.7.4 and 7.0.0 - 7.0.3 GHSA-xx7v-hqxh-cjr9
2.0.5 - 2.3.37 and 2.5 - 6.7.4 and 7.0.0 - 7.0.3 GHSA-xx7v-hqxh-cjr9
Critical
1 year ago
Apache Struts file upload logic is flawed
2.0.5 - 6.3.0.2 GHSA-43mq-6xmg-29vm
2.0.5 - 6.3.0.2 GHSA-43mq-6xmg-29vm
High Risk
2 years ago
Apache Struts Improper Control of Dynamically-Managed Code Resources vulnerability
2.0.5 - 2.5.31 and 6.0.0 - 6.1.2.1 and 6.2.0 - 6.3.0 GHSA-729q-fcgp-r5xh
2.0.5 - 2.5.31 and 6.0.0 - 6.1.2.1 and 6.2.0 - 6.3.0 GHSA-729q-fcgp-r5xh
Impacted packages
Timeline
Published
2 years ago
December 07, 2023 at 09:30 AM UTC
Fixed (2.5.33)
Unknown
Unknown
Fixed (6.3.0.2)
Unknown
Unknown
Last Modified
1 year ago
February 13, 2025 at 07:37 PM UTC