CVE-2024-53677

🗓️ 11 Dec 2024 15:35:43Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 19 Media mentions👁 4439 Views🌐 WEB

File upload flaw in Apache Struts affects versions before 6.4.0; upgrade recommended to fix.

Reporter	Title	Published	Views	Family All 53
IBM Security Bulletins	Security Bulletin: Remediation of Multiple Apache Struts 2.5.33 Vulnerabilities in IBM Library Support for Struts.	16 Jan 202609:11	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Struts library affect Tivoli Netcool/OMNIbus WebGUI (CVE-2024-53677)	28 Jan 202521:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities	26 Mar 202504:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities (CVE-2024-53677, CVE-2025-23184)	19 Jun 202505:35	–	ibm
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Apache Struts	13 Dec 202417:42	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Apache Struts	18 Dec 202418:42	–	githubexploit
GithubExploit	Exploit for CVE-2024-53667	22 May 202607:20	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Apache Struts	18 Dec 202402:03	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Apache Struts	8 Jan 202519:36	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Apache Struts	1 Sep 202513:17	–	githubexploit

NVD

Vulners

Node

apache strutsRange2.0.0–6.4.0

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.struts:struts2-core",
    "product": "Apache Struts",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "6.4.0",
        "status": "affected",
        "version": "2.0.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
cwiki	www.cwiki.apache.org/confluence/display/WW/S2-067
security	www.security.netapp.com/advisory/ntap-20250103-0005/

Parameter	Position	Path	Description	CWE
top.UploadFileName	request body	upload.action	Path traversal via file upload parameters leading to possible RCE when using legacy FileUploadInterceptor	CWE-434
uploadFileName[0]	request body	uploads.action	Path traversal via multi-file upload parameter enabling potential file write and RCE	CWE-434

17 Jun 2026 08:09Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.19.8

CVSS 49.5

EPSS0.78198

SSVC

CWE-434