Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2023-50164
HistoryDec 07, 2023 - 9:15 a.m.

CVE-2023-50164

2023-12-0709:15:07
CWE-552
[email protected]
web.nvd.nist.gov
6
file upload manipulation
paths traversal
remote code execution
upgrade
struts 2
struts 6

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.09

Percentile

94.6%

JSON

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.
Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Affected configurations

Nvd
Node
apachestrutsRange2.0.0–2.5.33
OR
apachestrutsRange6.0.0–6.3.0.2
VendorProductVersionCPE
apachestruts*cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*

Related

cnvd 1
akamaiblog 1
adobe 1
nessus 4
f5 1
openvas 1
cvelist 1
malwarebytes 2
srcincite 2
osv 2
githubexploit 9
hivepro 1
ibm 9
qualysblog 4
cve 1
prion 1
trendmicroblog 1
redhatcve 1
saint 2
ubuntucve 1
cisco 1
github 1
veracode 1
thn 1
impervablog 1
avleonov 1
oracle 1
cnvd
cnvd
Apache Struts Directory Traversal Vulnerability
2023-12-12 00:00:00
akamaiblog
akamaiblog
Observed Exploitation Attempts of Struts 2 S2-066 Vulnerability (CVE-2023-50164)
2023-12-14 10:00:40
adobe
adobe
APSB23-77 : Security update available for Adobe Experience Manager Forms
2023-12-15 00:00:00
nessus
nessus
Cisco Identity Services Engine RCE (cisco-sa-struts-C2kCMkmT)
2023-12-21 00:00:00
Adobe Experience Manager 6.0.0.0 < 6.5.19.1 Arbitrary code execution (APSB23-77)
2024-01-07 00:00:00
Apache Struts 2.5.0 < 2.5.33 / 6.0.0 < 6.3.0.2 Remote Code Execution (S2-066)
2023-12-07 00:00:00
f5
f5
K000137931 : Apache Struts vulnerability CVE-2023-50164
2023-12-15 00:00:00
openvas
openvas
Apache Struts Security Update (S2-066)
2023-12-08 00:00:00
cvelist
cvelist
CVE-2023-50164 Apache Struts: File upload component had a directory traversal vulnerability
2023-12-07 08:49:19
malwarebytes
malwarebytes
Recently-patched Apache Struts vulnerability used in worldwide attacks
2023-12-14 21:35:04
Microsoft patches 34 vulnerabilities, including one zero-day
2023-12-13 16:39:23
srcincite
srcincite
SRC-2023-0004 : Apache Struts Security Feature Bypass Remote Code Execution Vulnerability
2023-11-08 00:00:00
SRC-2024-0001 : Trackplus Allegra Service Desk Module UploadHelper upload Directory Traversal Remote Code Execution Vulnerability
2023-11-08 00:00:00
osv
osv
CVE-2023-50164
2023-12-07 09:15:07
Apache Struts vulnerable to path traversal
2023-12-07 09:30:45
githubexploit
githubexploit
Exploit for Files or Directories Accessible to External Parties in Apache Struts
2023-12-15 21:19:51
Exploit for Files or Directories Accessible to External Parties in Apache Struts
2023-12-22 02:20:11
Exploit for Files or Directories Accessible to External Parties in Apache Struts
2023-12-30 21:37:08
hivepro
hivepro
Critical Remote Code Execution Flaw Uncovered in Apache Struts 2
2023-12-15 06:56:04
ibm
ibm
Security Bulletin: Struts Vulnerability - Order Management does contain the Struts code and it is vulnerable with lower risk [CVE-2023-50164]
2024-02-07 22:07:01
Security Bulletin: CVE-2023-50164 may affect Apache Struts2 used by Content Collector for Email, Content Collector for File Systems and Content Collector for Microsoft SharePoint
2024-01-10 05:13:03
Security Bulletin: Vulnerabilities in Apache Struts library affect Tivoli Netcool/OMNIbus WebGUI (CVE-2023-50164)
2024-01-17 02:54:37
qualysblog
qualysblog
Detect and Manage the Risk of Apache Struts (CVE-2023-50164) Comprehensively
2024-01-12 22:44:26
Yet Another Apache Struts 2 Vulnerability – CVE-2023-50164
2023-12-26 14:06:14
Announcing TotalCloud™ 2.0 with TruRisk™ Insights: The Future of Cloud and SaaS Security
2024-02-07 13:55:00
cve
cve
CVE-2023-50164
2023-12-07 09:15:07
prion
prion
Design/Logic Flaw
2023-12-07 09:15:00
trendmicroblog
trendmicroblog
Decoding CVE-2023-50164: Unveiling the Apache Struts File Upload Exploit
2023-12-15 00:00:00
redhatcve
redhatcve
CVE-2023-50164
2023-12-11 06:27:16
saint
saint
Apache Struts file upload directory traversal
2023-12-20 00:00:00
Apache Struts file upload directory traversal
2023-12-20 00:00:00
ubuntucve
ubuntucve
CVE-2023-50164
2023-12-07 00:00:00
cisco
cisco
Apache Struts Vulnerability Affecting Cisco Products: December 2023
2023-12-12 16:00:00
github
github
Apache Struts vulnerable to path traversal
2023-12-07 09:30:45
veracode
veracode
Remote Code Execution (RCE)
2023-12-14 16:09:57
thn
thn
New Critical RCE Vulnerability Discovered in Apache Struts 2 - Patch Now
2023-12-12 05:23:00
impervablog
impervablog
CVE-2023-50164: A Critical Vulnerability in Apache Struts
2023-12-19 12:34:31
avleonov
avleonov
November 2023 – January 2024: New Vulristics Features, 3 Months of Microsoft Patch Tuesdays and Linux Patch Wednesdays, Year 2023 in Review
2024-02-01 17:07:20
oracle
oracle
Oracle Critical Patch Update Advisory - January 2024
2024-01-16 00:00:00

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.09

Percentile

94.6%

JSON
Related for NVD:CVE-2023-50164
cnvd1akamaiblog1adobe1nessus4f51openvas1cvelist1malwarebytes2srcincite2osv2githubexploit9hivepro1ibm9qualysblog4cve1prion1trendmicroblog1redhatcve1saint2ubuntucve1cisco1github1veracode1thn1impervablog1avleonov1oracle1