CVE-2024-53677 Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

🗓️ 11 Dec 2024 15:35:43Reported by apacheType

Flawed file upload logic in Apache Struts allows bypassing upload checks; upgrade to 6.4.0.

Reporter	Title	Published	Views	Family All 52
IBM Security Bulletins	Security Bulletin: Remediation of Multiple Apache Struts 2.5.33 Vulnerabilities in IBM Library Support for Struts.	16 Jan 202609:11	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Struts library affect Tivoli Netcool/OMNIbus WebGUI (CVE-2024-53677)	28 Jan 202521:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities	26 Mar 202504:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities (CVE-2024-53677, CVE-2025-23184)	19 Jun 202505:35	–	ibm
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Apache Struts	13 Dec 202417:42	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Apache Struts	18 Dec 202418:42	–	githubexploit
GithubExploit	Exploit for CVE-2024-53667	22 May 202607:20	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Apache Struts	18 Dec 202402:03	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Apache Struts	8 Jan 202519:36	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Apache Struts	1 Sep 202513:17	–	githubexploit

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.struts:struts2-core",
    "product": "Apache Struts",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "6.4.0",
        "status": "affected",
        "version": "2.0.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
cwiki	www.cwiki.apache.org/confluence/display/WW/S2-067

20 Dec 2024 15:50Current

CVSS 49.5

EPSS0.93161