12-16-2023, 05:27 AM
CVE-2023-50164, reported by Steven Seeley of Source Incite, enables path traversal by manipulating of file upload parameters and, in some cases, may allow attackers to upload malicious files that can be used to achieve remote code execution.
The vulnerability affects Apache Struts versions:
2.0.0 through 2.5.32
6.0.0 through 6.3.0.1
2.0.0 through 2.3.37
This vulnerability is easy to exploit.
https://nvd.nist.gov/vuln/detail/CVE-2023-50164 Base Score: 9.8!
Check here: https://www.trendmicro.com/en_us/researc...pload.html
and here: https://www.akamai.com/blog/security-res...n-attempts
PoC: https://github.com/jakabakos/CVE-2023-50...Struts-RCE
The vulnerability affects Apache Struts versions:
2.0.0 through 2.5.32
6.0.0 through 6.3.0.1
2.0.0 through 2.3.37
This vulnerability is easy to exploit.
https://nvd.nist.gov/vuln/detail/CVE-2023-50164 Base Score: 9.8!
Check here: https://www.trendmicro.com/en_us/researc...pload.html
and here: https://www.akamai.com/blog/security-res...n-attempts
PoC: https://github.com/jakabakos/CVE-2023-50...Struts-RCE