Description

Possible Remote Code Execution attack when using the Struts REST plugin with XStream handler to handle XML payloads.

Remediation

Upgrade to Struts 2.5.13 or Struts 2.3.34.

References

Security Bulletin S2-052

Related Vulnerabilities

TYPO3 Cryptographic Issues Vulnerability (CVE-2009-0255)

Oracle Database Server CVE-2007-5531 Vulnerability (CVE-2007-5531)

MySQL CVE-2019-2967 Vulnerability (CVE-2019-2967)

ownCloud Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-9049)

Drupal Core 8.6.x Remote Code Execution (8.6.0 - 8.6.9)

Severity

High

Classification

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Code Execution Known Vulnerabilities Acumonitor CWE-94 CVE-2017-9805