CVSS: 10.0EPSS: 51%CPEs: 2EXPL: 12CVE-2023-50164 – Apache Struts: File upload component had a directory traversal vulnerability
https://notcve.org/view.php?id=CVE-2023-50164
07 Dec 2023 — An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue. Un atacante puede manipular los parámetros de carga de archivos para permitir path traversal y, en algunas circunstancias, esto puede provocar la carga de un archivo malicioso que puede usarse para realizar l... • https://github.com/bcdannyboy/CVE-2023-50164 • CWE-552: Files or Directories Accessible to External Parties •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-41835 – Apache Struts: excessive disk usage
https://notcve.org/view.php?id=CVE-2023-41835
05 Dec 2023 — When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue. Cuando se realiza una solicitud multiparte pero algunos de los campos exceden el límite maxStringLength, los archivos cargados permanecerán en struts.multipart.saveDir incluso si la solicitud ha sido ... • https://lists.apache.org/thread/6wj530kh3ono8phr642y9sqkl67ys2ft • CWE-459: Incomplete Cleanup •
CVSS: 7.8EPSS: 1%CPEs: 2EXPL: 0CVE-2023-34396 – Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms
https://notcve.org/view.php?id=CVE-2023-34396
14 Jun 2023 — Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater • http://www.openwall.com/lists/oss-security/2023/06/14/3 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.8EPSS: 2%CPEs: 2EXPL: 0CVE-2023-34149 – Apache Struts: DoS via OOM owing to not properly checking of list bounds
https://notcve.org/view.php?id=CVE-2023-34149
14 Jun 2023 — Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater. • http://www.openwall.com/lists/oss-security/2023/06/14/2 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 9.8EPSS: 90%CPEs: 1EXPL: 8CVE-2021-31805 – Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.
https://notcve.org/view.php?id=CVE-2021-31805
12 Apr 2022 — The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation. La corrección emitida para CVE-2020-17530 era incompleta. Así, desde Apache Struts versiones 2.0.0 hasta 2.5.29, todavía algunos de los atributos de las etiquetas po... • https://github.com/Wrin9/CVE-2021-31805 • CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') •
CVSS: 9.8EPSS: 96%CPEs: 13EXPL: 13CVE-2020-17530 – Apache Struts Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-17530
11 Dec 2020 — Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25. Una evaluación OGNL forzada, cuando se evalúa según la entrada del usuario sin procesar en los atributos de la etiqueta, puede conllevar a una ejecución de código remota. Software afectado: Apache Struts versión 2.0.0 - Struts versión 2.5.25 The Apache Struts framework, when forced, performs double evaluation of attribute values assigned... • https://packetstorm.news/files/id/160721 • CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') •
CVSS: 7.5EPSS: 15%CPEs: 6EXPL: 0CVE-2019-0233
https://notcve.org/view.php?id=CVE-2019-0233
14 Sep 2020 — An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload. Una anulación del permiso de acceso en Apache Struts versiones 2.0.0 hasta 2.5.20, puede causar una Denegación de Servicio al llevar a cabo una carga de archivo • https://cwiki.apache.org/confluence/display/ww/s2-060 • CWE-281: Improper Preservation of Permissions •
CVSS: 9.8EPSS: 95%CPEs: 6EXPL: 12CVE-2019-0230 – Apache Struts 2.5.20 - Double OGNL evaluation
https://notcve.org/view.php?id=CVE-2019-0230
14 Sep 2020 — Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Apache Struts versiones 2.0.0 hasta 2.5.20, forzó una evaluación OGNL doble, cuando se evaluaba en la entrada del usuario sin procesar en los atributos de la etiqueta, puede conllevar a una ejecución de código remota The Apache Struts framework, when forced, performs double evaluation of attribute values assigned to certain tags attributes such as id. It is ther... • https://packetstorm.news/files/id/160108 • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 9.3EPSS: 97%CPEs: 13EXPL: 24CVE-2018-11776 – Apache Struts Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-11776
22 Aug 2018 — Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace. Apache Struts, desde la versión 2.3 hasta la ... • https://packetstorm.news/files/id/172830 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1327
https://notcve.org/view.php?id=CVE-2018-1327
27 Mar 2018 — The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16. El plugin REST en Apache Struts emplea una bibli... • http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html •