GHSA-2j39-qcjm-428w

Source

https://github.com/advisories/GHSA-2j39-qcjm-428w

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-2j39-qcjm-428w/GHSA-2j39-qcjm-428w.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2j39-qcjm-428w

Aliases

CVE-2023-50164

Published

2023-12-07T09:30:45Z

Modified

2025-02-13T19:37:36.650649Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Apache Struts vulnerable to path traversal

Details

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Database specific

{
    "severity": "CRITICAL",
    "nvd_published_at": "2023-12-07T09:15:07Z",
    "github_reviewed_at": "2023-12-07T21:34:55Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-552"
    ]
}

References

Affected packages

Maven / org.apache.struts:struts2-core

Package

Name: org.apache.struts:struts2-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.struts/struts2-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.0

Fixed

2.5.33

Affected versions

2.*

2.0.5

2.0.6

2.0.8

2.0.9

2.0.11

2.0.11.1

2.0.11.2

2.0.12

2.0.14

2.1.2

2.1.6

2.1.8

2.1.8.1

2.2.1

2.2.1.1

2.2.3

2.2.3.1

2.3.1

2.3.1.1

2.3.1.2

2.3.3

2.3.4

2.3.4.1

2.3.7

2.3.8

2.3.12

2.3.14

2.3.14.1

2.3.14.2

2.3.14.3

2.3.15

2.3.15.1

2.3.15.2

2.3.15.3

2.3.16

2.3.16.1

2.3.16.2

2.3.16.3

2.3.20

2.3.20.1

2.3.20.3

2.3.24

2.3.24.1

2.3.24.3

2.3.28

2.3.28.1

2.3.29

2.3.30

2.3.31

2.3.32

2.3.33

2.3.34

2.3.35

2.3.36

2.3.37

2.5-BETA1

2.5-BETA2

2.5-BETA3

2.5

2.5.1

2.5.2

2.5.5

2.5.8

2.5.10

2.5.10.1

2.5.12

2.5.13

2.5.14

2.5.14.1

2.5.16

2.5.17

2.5.18

2.5.20

2.5.22

2.5.25

2.5.26

2.5.27

2.5.28

2.5.28.1

2.5.28.2

2.5.28.3

2.5.29

2.5.30

2.5.31

2.5.32

Maven / org.apache.struts:struts2-core

Package

Name: org.apache.struts:struts2-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.struts/struts2-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.0

Fixed

6.3.0.2

Affected versions

6.*

6.0.0

6.0.3

6.1.1

6.1.2

6.1.2.1

6.1.2.2

6.2.0

6.3.0

6.3.0.1