Description

The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

Remediation

References

http://struts.apache.org/docs/s2-048.html

http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html

http://www.securityfocus.com/bid/99484

http://www.securitytracker.com/id/1038838

https://security.netapp.com/advisory/ntap-20180706-0002/

https://www.exploit-db.com/exploits/42324/

https://www.exploit-db.com/exploits/44643/

Related Vulnerabilities

CVE-2017-7669 Vulnerability in maven package org.apache.hadoop:hadoop-common

CVE-2022-45875 Vulnerability in maven package org.apache.dolphinscheduler:dolphinscheduler-alert-plugins

CVE-2019-10288 Vulnerability in maven package de.e-nexus:jabber-server-plugin

CVE-2022-25845 Vulnerability in maven package com.alibaba:fastjson

CVE-2021-45046 Vulnerability in maven package org.apache.logging.log4j:log4j-core

Severity

Critical

Classification

CWE-20 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Mitigation Vendor Advisory Patch Third Party Advisory VDB Entry