CVE-2023-50164

🗓️ 07 Dec 2023 08:49:19Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 12 Media mentions👁 389 Views🌐 WEB

An attacker can manipulate file upload params to enable paths traversal and perform Remote Code Execution

Reporter	Title	Published	Views	Family All 69
GithubExploit	Exploit for Files or Directories Accessible to External Parties in Apache Struts	30 Dec 202321:37	–	githubexploit
GithubExploit	Exploit for Files or Directories Accessible to External Parties in Apache Struts	15 Dec 202321:19	–	githubexploit
GithubExploit	Exploit for Files or Directories Accessible to External Parties in Apache Struts	13 Dec 202309:31	–	githubexploit
GithubExploit	Exploit for Files or Directories Accessible to External Parties in Apache Struts	17 Dec 202314:18	–	githubexploit
GithubExploit	Exploit for Files or Directories Accessible to External Parties in Apache Struts	4 Sep 202518:35	–	githubexploit
GithubExploit	Exploit for Files or Directories Accessible to External Parties in Apache Struts	6 Oct 202414:58	–	githubexploit
GithubExploit	Exploit for Files or Directories Accessible to External Parties in Apache Struts	12 Jan 202409:34	–	githubexploit
GithubExploit	Exploit for Files or Directories Accessible to External Parties in Apache Struts	20 Dec 202308:39	–	githubexploit
GithubExploit	Exploit for Files or Directories Accessible to External Parties in Apache Struts	5 Mar 202512:01	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Apache Struts	3 Jan 202502:30	–	githubexploit

NVD

Vulners

Node

apache strutsRange2.0.0–2.5.33

apache strutsRange6.0.0–6.3.0.2

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.struts",
    "product": "Apache Struts",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.5.32",
        "status": "affected",
        "version": "2.0.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "6.3.0.1",
        "status": "affected",
        "version": "6.0.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
security	www.security.netapp.com/advisory/ntap-20231214-0010/
openwall	www.openwall.com/lists/oss-security/2023/12/07/1
packetstormsecurity	www.packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.html
lists	www.lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj

Parameter	Position	Path	Description	CWE
uploadFileFileName	request body	allegra/excelUpload.action	Directory traversal leading to arbitrary file upload and potential remote code execution via Trackplus Allegra upload endpoint	CWE-552

13 Feb 2025 18:15Current

9.8High risk

Vulners AI Score9.8

CVSS 3.19.8

EPSS0.92896

CWE-552