Description
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
Remediation
References
Related Vulnerabilities
Drupal Core 4.7.x Cross-Site Scripting (4.7.0 - 4.7.10)
WordPress Plugin JoomSport-for Sports: Team & League, Football, Hockey & more SQL Injection (3.3)
PostgreSQL Other Vulnerability (CVE-1999-0862)
WordPress Plugin Contact Form 7 Cross-Site Scripting (4.0.1)
PHP Improper Check for Unusual or Exceptional Conditions Vulnerability (CVE-2017-11144)