GHSA-2j39-qcjm-428w

Source
https://github.com/advisories/GHSA-2j39-qcjm-428w
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-2j39-qcjm-428w/GHSA-2j39-qcjm-428w.json
Aliases
Published
2023-12-07T09:30:45Z
Modified
2024-02-19T05:31:15.879007Z
Details

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

References

Affected packages

Maven / org.apache.struts:struts2-core

Package

Name
org.apache.struts:struts2-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.5.33

Affected versions

2.*

2.0.5
2.0.6
2.0.8
2.0.9
2.0.11
2.0.11.1
2.0.11.2
2.0.12
2.0.14
2.1.2
2.1.6
2.1.8
2.1.8.1
2.2.1
2.2.1.1
2.2.3
2.2.3.1
2.3.1
2.3.1.1
2.3.1.2
2.3.3
2.3.4
2.3.4.1
2.3.7
2.3.8
2.3.12
2.3.14
2.3.14.1
2.3.14.2
2.3.14.3
2.3.15
2.3.15.1
2.3.15.2
2.3.15.3
2.3.16
2.3.16.1
2.3.16.2
2.3.16.3
2.3.20
2.3.20.1
2.3.20.3
2.3.24
2.3.24.1
2.3.24.3
2.3.28
2.3.28.1
2.3.29
2.3.30
2.3.31
2.3.32
2.3.33
2.3.34
2.3.35
2.3.36
2.3.37
2.5-BETA1
2.5-BETA2
2.5-BETA3
2.5
2.5.1
2.5.2
2.5.5
2.5.8
2.5.10
2.5.10.1
2.5.12
2.5.13
2.5.14
2.5.14.1
2.5.16
2.5.17
2.5.18
2.5.20
2.5.22
2.5.25
2.5.26
2.5.27
2.5.28
2.5.28.1
2.5.28.2
2.5.28.3
2.5.29
2.5.30
2.5.31
2.5.32

Maven / org.apache.struts:struts2-core

Package

Name
org.apache.struts:struts2-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.3.0.2

Affected versions

6.*

6.0.0
6.0.3
6.1.1
6.1.2
6.1.2.1
6.1.2.2
6.2.0
6.3.0
6.3.0.1