CVE-2024-53677

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-53677
File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe. You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067
CVSS

No CVSS.

References
Link Resource
https://cwiki.apache.org/confluence/display/WW/S2-067
https://security.netapp.com/advisory/ntap-20250103-0005/
Configurations

No configuration.

History

03 Jan 2025, 12:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20250103-0005/ -

20 Dec 2024, 16:15

Type Values Removed Values Added
Summary (en) File upload logic is flawed vulnerability in Apache Struts. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067 (en) File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe. You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067

18 Dec 2024, 01:15

Type Values Removed Values Added
Summary (en) File upload logic is flawed vulnerability in Apache Struts. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067 (en) File upload logic is flawed vulnerability in Apache Struts. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067

16 Dec 2024, 10:15

Type Values Removed Values Added
Summary (en) File upload logic is flawed vulnerability in Apache Struts. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0, which fixes the issue. You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067 (en) File upload logic is flawed vulnerability in Apache Struts. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067

12 Dec 2024, 16:15

Type Values Removed Values Added
Summary
  • (es) La lógica de carga de archivos es una vulnerabilidad defectuosa en Apache Struts. Este problema afecta a Apache Struts: desde la versión 2.0.0 hasta la 6.4.0. Se recomienda a los usuarios que actualicen a la versión 6.4.0, que soluciona el problema. Puede encontrar más detalles en https://cwiki.apache.org/confluence/display/WW/S2-067
CWE CWE-434

11 Dec 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-11 16:15

Updated : 2025-01-03 12:15

NVD link : CVE-2024-53677

Mitre link : CVE-2024-53677

CVE.ORG link : CVE-2024-53677

JSON object : View

Products Affected

No product.

CWE
CWE-434

Unrestricted Upload of File with Dangerous Type