mickmick.net

Apache Struts Remote Code Execution Vulnerability

Release Date: 11 Dec 2023

RISK: Medium Risk

TYPE: Servers - Web Servers

A vulnerability has been identified in Apache Struts. A remote user can exploit this vulnerability to trigger remote code execution on the targeted system.

---

Impact

• Remote Code Execution

---

System / Technologies affected

• Struts 2.0.0 - Struts 2.3.37 (EOL)
• Struts 2.5.0 - Struts 2.5.32
• Struts 6.0.0 - Struts 6.3.0

---

Solutions

Before installation of the software, please visit the software manufacturer web-site for more details.

• Upgrade to Struts 2.5.33, Struts 6.3.0.2 or greater

---

Vulnerability Identifier

• CVE-2023-50164

---

Source

• AusCERT
• Apache

---

Related Link

• https://www.auscert.org.au/bulletins/ESB-2023.7339.2
• https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj
• https://cwiki.apache.org/confluence/display/WW/S2-066