The vulnerability of the Jakarta Multipart parser on the Apache Struts software platform allows attackers to execute arbitrary commands.

🗓️ 02 Jun 2017 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Jakarta Multipart parser in Apache Struts allows arbitrary command execution via crafted Content-Type header with #cmd=string.

Reporter	Title	Published	Views	Family All 204
IBM Security Bulletins	Security Bulletin: A vulnerability in Apache Struts 2 affects IBM Platform Symphony and IBM Spectrum Symphony (CVE-2017-5638)	18 Jun 201801:35	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in Apache Struts affects Storwize V7000 Unified (CVE-2017-5638)	18 Jun 201800:34	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Struts v2 Jakarta Multipart parser code execution affects IBM Platform Cluster Manager Standard Edition, IBM Platform Cluster Manager Advanced Edition, Platform HPC, and Spectrum Cluster Foundation (CVE-2017-5638)	18 Jun 201801:35	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Struts affects IBM Social Media Analytics (CVE-2017-5638)	15 Jun 201822:50	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in Apache Struts affects the IBM FlashSystem model V840	18 Jun 201800:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Order Management is affected by a vulnerability (CVE-2017-5638)	16 Jun 201820:09	–	ibm
IBM Security Bulletins	WebSphere Application Server and IBM HTTP Server Security Bulletin List	13 Jul 202218:04	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in Apache Struts affects the IBM FlashSystem models 840 and 900	18 Feb 202301:45	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Struts affects SAN Volume Controller, Storwize family and FlashSystem V9000 products (CVE-2017-5638)	29 Mar 202301:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM OpenPages GRC Platform Web Applications are not vulnerable to (CVE-2017-5638)	15 Jun 201822:49	–	ibm

Vulners

Node

apache strutsRange2.2.3–2.3.32

apache strutsRange2.5–2.5.10.1

Source	Link
blog	www.blog.talosintelligence.com/2017/03/apache-0-day-exploited.html
blog	www.blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/
eweek	www.eweek.com/security/apache-struts-vulnerability-under-attack.html
securityfocus	www.securityfocus.com/bid/96729
arstechnica	www.arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/
cwiki	www.cwiki.apache.org/confluence/display/WW/S2-045
exploit-db	www.exploit-db.com/exploits/41570
git1-us-west	www.git1-us-west.apache.org/repos/asf
git1-us-west	www.git1-us-west.apache.org/repos/asf
github	www.github.com/mazen160/struts-pwn

24 Sep 2024 00:00Current

8.2High risk

Vulners AI Score8.2

CVSS 210

EPSS0.94267