Lucene search
IBM02304D05D897B568E77C8953094F5914F389089362655D2AB68B096E3F3418DCHistoryJun 18, 2018 - 1:35 a.m.
Security Bulletin: A vulnerability in Apache Struts 2 affects IBM Platform Symphony and IBM Spectrum Symphony (CVE-2017-5638)
2018-06-1801:35:45
www.ibm.com
37
10 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
Summary
A Security vulnerability relating to remote code execution CVE-2017-5638 (S2-045) has been reported against Apache Struts 2, which IBM Platform Symphony uses as a framework for its WEBGUI service. The Struts 2 package version that is vulnerable to these issues is included in several past versions of IBM Platform Symphony Advanced Edition and Developer Edition. Struts 2.3.32 addresses this vulnerability and can be applied through the manual steps detailed in the Remediation section.
Vulnerability Details
CVEID: CVE-2017-5638
DESCRIPTION: Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by an error when performing a file upload based on Jakarta Multipart parser. An attacker could exploit this vulnerability using a malicious Content-Type value to execute arbitrary code on the system.
**CVSS Base Score:**7.3
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/122776 for the current score
*CVSS 3.0 Environmental Score:**Undefined
CVSS Vector:****(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Affected Products and Versions
IBM Platform Symphony 6.1.1, 7.1 Fix Pack 1, and** 7.1.1**,andIBM Spectrum Symphony** 7.1.2** and7.2. All OS editions, including Linux and Windows, are affected. The remediation steps for Linux are provided in this document. For Windows, use the Linux steps as a reference and find the correct path for patching.
Remediation/Fixes
1. For IBM Platform Symphony 6.1.1 or 7.1 Fix Pack 1, download the appropriate fix and follow the instructions in the readme file to upgrade to Struts version 2.3.32.
| Product version | Fix ID |
|---|---|
| IBM Platform Symphony 6.1.1 | sym-6.1.1-build446371 |
| IBM Platform Symphony 7.1 Fix Pack 1 | sym-7.1-build446807 |
| 2. For IBM Platform Symphony 7.1.1 and higher, follow the steps to update to Struts version 2.3.32 on Linux hosts: 2.1 Log on to each management host in the cluster and download the struts-2.3.32-lib.zip package from the following location: http://archive.apache.org/dist/struts/2.3.32/struts-2.3.32-lib.zip 2.2 Stop the Platform Management Console service (WEBGUI): > egosh service stop WEBGUI 2.3 For backup purposes, move the following files, which will be replaced by new files: - For IBM Platform Symphony 7.1.1: | |
| > mkdir -p /tmp/guibackup/symgui | |
| > mkdir -p /tmp/guibackup/perfgui | |
| > mv $EGO_TOP/gui/3.3/lib/commons-fileupload-1.3.1.jar /tmp/guibackup/ | |
| > mv $EGO_TOP/gui/3.3/lib/commons-io-1.2.jar /tmp/guibackup/ | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/commons-fileupload-*.jar /tmp/guibackup/symgui/ | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/org.apache.commons-io-*.jar /tmp/guibackup/symgui/ | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/commons-lang3-*.jar /tmp/guibackup/symgui/ | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/freemarker-*.jar /tmp/guibackup/symgui/ | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/javassist-*.jar /tmp/guibackup/symgui/ | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/ognl-*.jar /tmp/guibackup/symgui/ | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/struts2-core-*.jar /tmp/guibackup/symgui/ | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/struts2-json-plugin-*.jar /tmp/guibackup/symgui/ | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/struts2-spring-plugin-*.jar /tmp/guibackup/symgui/ | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/xstream-*.jar /tmp/guibackup/symgui/ | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/xwork-core-*.jar /tmp/guibackup/symgui/ | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/velocity-1.5.jar /tmp/guibackup/symgui/ | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/perf/3.3/perfgui/WEB-INF/lib/freemarker-*.jar /tmp/guibackup/perfgui/ | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/perf/3.3/perfgui/WEB-INF/lib/ognl-*.jar /tmp/guibackup/perfgui/ | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/perf/3.3/perfgui/WEB-INF/lib/struts2-core-*.jar /tmp/guibackup/perfgui/ | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/perf/3.3/perfgui/WEB-INF/lib/xwork-core-*.jar /tmp/guibackup/perfgui/ | |
| - For IBM Spectrum Symphony 7.1.2 and 7.2: | |
| > mkdir -p /tmp/guibackup/egogui | |
| > mkdir -p /tmp/guibackup/perfgui | |
| > mv $EGO_TOP/gui/$EGO_VERSION/lib/commons-fileupload-*.jar /tmp/guibackup/ | |
| > mv $EGO_TOP/gui/$EGO_VERSION/lib/commons-io-*.jar /tmp/guibackup/ | |
| > mv $EGO_TOP/gui/$EGO_VERSION/lib/commons-lang3-*.jar /tmp/guibackup/ | |
| > mv $EGO_TOP/gui/$EGO_VERSION/lib/org.apache.commons-io-*.jar /tmp/guibackup/ | |
| > mv $EGO_TOP/gui/$EGO_VERSION/lib/freemarker-*.jar /tmp/guibackup/ | |
| > mv $EGO_TOP/gui/$EGO_VERSION/lib/javassist-*.jar /tmp/guibackup/ | |
| > mv $EGO_TOP/gui/$EGO_VERSION/lib/ognl-*.jar /tmp/guibackup/ | |
| > mv $EGO_TOP/gui/$EGO_VERSION/lib/struts2-core-*.jar /tmp/guibackup/ | |
| > mv $EGO_TOP/gui/$EGO_VERSION/lib/struts2-json-plugin-*.jar /tmp/guibackup/ | |
| > mv $EGO_TOP/gui/$EGO_VERSION/lib/struts2-spring-plugin-*.jar /tmp/guibackup/ | |
| > mv $EGO_TOP/gui/$EGO_VERSION/lib/xwork-core-*.jar /tmp/guibackup/ | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/ego/$EGO_VERSION/platform/WEB-INF/lib/xstream-*.jar /tmp/guibackup/egogui/ | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/ego/$EGO_VERSION/platform/WEB-INF/lib/velocity-1.5.jar /tmp/guibackup/egogui/ | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/perf/$EGO_VERSION/perfgui/WEB-INF/lib/freemarker-*.jar /tmp/guibackup/perfgui | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/perf/$EGO_VERSION/perfgui/WEB-INF/lib/ognl-*.jar /tmp/guibackup/perfgui | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/perf/$EGO_VERSION/perfgui/WEB-INF/lib/struts2-core-*.jar /tmp/guibackup/perfgui | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/perf/$EGO_VERSION/perfgui/WEB-INF/lib/xwork-core-*.jar /tmp/guibackup/perfgui | |
| > mkdir -p /tmp/guibackup/perfguiv5 (For 7.2 Only) | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/perf/$EGO_VERSION/perfguiv5/WEB-INF/lib/ognl-*.jar /tmp/guibackup/perfguiv5 (For 7.2 Only) | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/perf/$EGO_VERSION/perfguiv5/WEB-INF/lib/freemarker-*.jar /tmp/guibackup/perfguiv5 (For 7.2 Only) | |
| > mv $EGO_TOP/wlp/usr/servers/gui/apps/perf/$EGO_VERSION/perfguiv5/WEB-INF/lib/xwork-core-*.jar /tmp/guibackup/perfguiv5 (For 7.2 Only) 2.4 On each management host, unzip the struts-2.3.32-lib.zip package and copy the following files to your cluster directory:- For IBM Platform Symphony 7.1.1: | |
| > unzip -u struts-2.3.32-lib.zip | |
| > cd struts-2.3.32/lib/ | |
| > cp commons-fileupload-1.3.2.jar $EGO_TOP/gui/3.3/lib/ | |
| > cp commons-io-2.2.jar $EGO_TOP/gui/3.3/lib/ | |
| > cp commons-lang3-3.2.jar $EGO_TOP/gui/3.3/lib/ | |
| > cp commons-fileupload-1.3.2.jar $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/ | |
| > cp commons-io-2.2.jar $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/ | |
| > cp commons-lang3-3.2.jar $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/ | |
| > cp freemarker-2.3.22.jar $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/ | |
| > cp javassist-3.11.0.GA.jar $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/ | |
| > cp ognl-3.0.19.jar $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/ | |
| > cp struts2-core-2.3.32.jar $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/ | |
| > cp struts2-json-plugin-2.3.32.jar $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/ | |
| > cp struts2-spring-plugin-2.3.32.jar $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/ | |
| > cp xstream-1.4.8.jar $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/ | |
| > cp xwork-core-2.3.32.jar $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/ | |
| > cp velocity-1.6.4.jar $EGO_TOP/wlp/usr/servers/gui/apps/soam/7.1.1/symgui/WEB-INF/lib/ | |
| > cp freemarker-2.3.22.jar $EGO_TOP/wlp/usr/servers/gui/apps/perf/3.3/perfgui/WEB-INF/lib/ | |
| > cp ognl-3.0.19.jar $EGO_TOP/wlp/usr/servers/gui/apps/perf/3.3/perfgui/WEB-INF/lib/ | |
| > cp struts2-core-2.3.32.jar $EGO_TOP/wlp/usr/servers/gui/apps/perf/3.3/perfgui/WEB-INF/lib/ | |
| > cp xwork-core-2.3.32.jar $EGO_TOP/wlp/usr/servers/gui/apps/perf/3.3/perfgui/WEB-INF/lib/ | |
| - For IBM Spectrum Symphony 7.1.2 and 7.2: | |
| > unzip -u struts-2.3.32-lib.zip | |
| > cd struts-2.3.32/lib/ | |
| > cp commons-fileupload-1.3.2.jar $EGO_TOP/gui/$EGO_VERSION/lib/ | |
| > cp commons-io-2.2.jar $EGO_TOP/gui/$EGO_VERSION/lib/ | |
| > cp commons-lang3-3.2.jar $EGO_TOP/gui/$EGO_VERSION/lib/ | |
| > cp freemarker-2.3.22.jar $EGO_TOP/gui/$EGO_VERSION/lib/ | |
| > cp javassist-3.11.0.GA.jar $EGO_TOP/gui/$EGO_VERSION/lib/ | |
| > cp ognl-3.0.19.jar $EGO_TOP/gui/$EGO_VERSION/lib/ | |
| > cp struts2-core-2.3.32.jar $EGO_TOP/gui/$EGO_VERSION/lib/ | |
| > cp struts2-json-plugin-2.3.32.jar $EGO_TOP/gui/$EGO_VERSION/lib/ | |
| > cp struts2-spring-plugin-2.3.32.jar $EGO_TOP/gui/$EGO_VERSION/lib/ | |
| > cp xwork-core-2.3.32.jar $EGO_TOP/gui/$EGO_VERSION/lib/ | |
| > cp xstream-1.4.8.jar $EGO_TOP/wlp/usr/servers/gui/apps/ego/$EGO_VERSION/platform/WEB-INF/lib/ | |
| > cp velocity-1.6.4.jar $EGO_TOP/wlp/usr/servers/gui/apps/ego/$EGO_VERSION/platform/WEB-INF/lib/ | |
| > cp freemarker-2.3.22.jar $EGO_TOP/wlp/usr/servers/gui/apps/perf/$EGO_VERSION/perfgui/WEB-INF/lib/ | |
| > cp ognl-3.0.19.jar $EGO_TOP/wlp/usr/servers/gui/apps/perf/$EGO_VERSION/perfgui/WEB-INF/lib/ | |
| > cp struts2-core-2.3.32.jar $EGO_TOP/wlp/usr/servers/gui/apps/perf/$EGO_VERSION/perfgui/WEB-INF/lib/ | |
| > cp xwork-core-2.3.32.jar $EGO_TOP/wlp/usr/servers/gui/apps/perf/$EGO_VERSION/perfgui/WEB-INF/lib/ | |
| > cp ognl-3.0.19.jar $EGO_TOP/wlp/usr/servers/gui/apps/perf/$EGO_VERSION/perfguiv5/WEB-INF/lib/ (For 7.2 Only) | |
| > cp freemarker-2.3.22.jar $EGO_TOP/wlp/usr/servers/gui/apps/perf/$EGO_VERSION/perfguiv5/WEB-INF/lib/ (For 7.2 Only) | |
| > cp xwork-core-2.3.32.jar $EGO_TOP/wlp/usr/servers/gui/apps/perf/$EGO_VERSION/perfguiv5/WEB-INF/lib/ (For 7.2 Only) 2.5 Clean up the GUI work directories on all management hosts: > rm -rf $EGO_TOP/gui/work/* | |
| > rm -rf $EGO_TOP/gui/workarea/* | |
| **NOTE:**If you changed the default configuration for the WLP_OUTPUT_DIR environment variable and the APPEND_HOSTNAME_TO_WLP_OUTPUT_DIR parameter is set to true in the $EGO_CONFDIR/wlp.conf file, you must clean up the $WLP_OUTPUT_DIR/webgui_hostname/gui/workarea/ directory. 2.6 Launch a web browser and clear your browser’s cache. | |
| 2.7 Start the WEBGUI service: > egosh service start WEBGUI |
| CPE | Name | Operator | Version |
|---|---|---|---|
| ibm spectrum symphony | eq | 7.1.2 | |
| ibm spectrum symphony | eq | any |
Related
ibm
ibm
canvas
canvas
Immunity Canvas: STRUTS_OGNL
2017-03-11 02:59:00
hackerone
hackerone
U.S. Dept Of Defense: Remote Code Execution (RCE) in a DoD website
2017-03-09 17:59:08
U.S. Dept Of Defense: Remote code execution vulnerability on a DoD website
2017-03-13 04:14:12
U.S. Dept Of Defense: Remote Code Execution (RCE) in a DoD website
2017-03-13 13:22:29
malwarebytes
malwarebytes
Equifax breach: What you need to know [updated]
2017-09-08 07:02:47
packetstorm
packetstorm
Apache Struts 2 2.3.x / 2.5.x Remote Code Execution
2017-03-10 00:00:00
Apache Struts Jakarta Multipart Parser OGNL Injection
2017-03-14 00:00:00
threatpost
threatpost
Equifax to Pay $700 Million in 2017 Data Breach Settlement
2019-07-22 14:31:39
Equifax Says 2.4 Million More People Impacted By Massive 2017 Breach
2018-03-02 15:12:57
Attacks Heating Up Against Apache Struts 2 Vulnerability
2017-03-09 12:25:46
myhack58
myhack58
Apache Struts2 exposure arbitrary code execution vulnerability (S2-045,CVE-2017-5638)-vulnerability warning-the black bar safety net
2017-03-07 00:00:00
qualysblog
qualysblog
How To Prioritize Vulnerabilities in a Modern IT Environment
2018-05-07 16:00:10
The Sky Is Falling! Responding Rationally to Headline Vulnerabilities
2018-04-19 23:00:03
nessus
nessus
Apache Struts 2.3.5 - 2.3.31 / 2.5.x < 2.5.10.1 Jakarta Multipart Parser RCE (remote)
2017-03-08 00:00:00
Apache Struts 2 RCE (CVE-2017-5638) (deprecated)
2017-04-12 00:00:00
openvas
openvas
Atlassian Bamboo Struts2 RCE Vulnerability
2017-03-15 00:00:00
VMware vRealize Operations Apache Struts2 RCE Vulnerability (VMSA-2017-0004)
2017-03-31 00:00:00
thn
thn
UK Regulator Fines Equifax £500,000 Over 2017 Data Breach
2018-09-20 13:54:00
New Apache Struts Zero-Day Vulnerability Being Exploited in the Wild
2017-03-09 01:03:00
Whoops, Turns Out 2.5 Million More Americans Were Affected By Equifax Breach
2017-10-02 21:23:00
krebs
krebs
Equifax Hackers Stole 200k Credit Card Accounts in One Fell Swoop
2017-09-14 18:03:12
atlassian
atlassian
Apache Struts 2 Remote Code Execution (CVE-2017-5638)
2017-03-10 04:31:09
Apache Struts 2 Remote Code Execution (CVE-2017-5638)
2017-03-10 04:57:51
Apache Struts 2 Remote Code Execution (CVE-2017-5638)
2017-03-10 04:57:51
lenovo
lenovo
Apache Struts Open Source Framework Remote Code Execution - us
2017-06-09 00:00:00
osv
osv
CVE-2017-5638
2017-03-11 02:59:00
f5
f5
K43451236 : Apache Struts 2 vulnerability CVE-2017-5638
2017-03-09 00:00:00
saint
saint
Apache Struts 2 Jakarta Multipart Parser file upload command execution
2017-03-16 00:00:00
Apache Struts 2 Jakarta Multipart Parser file upload command execution
2017-03-16 00:00:00
Apache Struts 2 Jakarta Multipart Parser file upload command execution
2017-03-16 00:00:00
kitploit
kitploit
struts-pwn - An exploit for Apache Struts CVE-2017-5638
2017-03-14 13:34:00
checkpoint_advisories
checkpoint_advisories
Apache Struts2 Content-Type Remote Code Execution (CVE-2017-5638)
2017-03-07 00:00:00
Apache Struts 2 Content-Disposition Remote Code Execution (CVE-2017-5638)
2017-08-09 00:00:00
redhatcve
redhatcve
CVE-2017-5638
2017-03-08 11:53:37
trendmicroblog
trendmicroblog
Sound, Fury, And Nothing One Year After Equifax
2018-09-07 12:00:34
Linux is secure…right?
2017-06-15 19:00:13
vmware
vmware
prion
prion
Design/Logic Flaw
2017-03-11 02:59:00
impervablog
impervablog
Clustering App Attacks with Machine Learning Part 3: Algorithm Results
2018-06-19 22:41:03
rapid7community
rapid7community
Apache Struts Vulnerability (CVE-2017-5638) Exploit Traffic
2017-03-15 14:29:55
attackerkb
attackerkb
CVE-2017-5638
2017-03-11 00:00:00
CVE-2019-0230
2020-09-14 00:00:00
ubuntucve
ubuntucve
CVE-2017-5638
2017-03-11 00:00:00
seebug
seebug
S2-046: Struts 2 Remote Code Execution vulnerability（CVE-2017-5638）
2017-03-21 00:00:00
S2-045: Struts 2 Remote Code Execution vulnerability（CVE-2017-5638）
2017-03-06 00:00:00
securelist
securelist
Unveiling NKAbuse: a new multiplatform threat abusing the NKN protocol
2023-12-14 13:00:40
cisco
cisco
cisa_kev
cisa_kev
Apache Struts Remote Code Execution Vulnerability
2021-11-03 00:00:00
zdt
zdt
Apache Struts 2 2.3.x / 2.5.x Remote Code Execution Exploit
2017-03-12 00:00:00
Apache Struts Jakarta Multipart Parser OGNL Injection Exploit
2017-03-15 00:00:00
veracode
veracode
Remote Code Execution (RCE) Through Jakarta Multipart Parser
2017-03-09 12:39:55
cve
cve
CVE-2017-5638
2017-03-11 02:59:00
cert
cert
Apache Struts 2 is vulnerable to remote code execution
2017-03-14 00:00:00
cloudfoundry
cloudfoundry
CVE-2017-5638: Apache Struts Remote Code Execution | Cloud Foundry
2017-03-14 00:00:00
huawei
huawei
github
github
Apache Struts vulnerable to remote arbitrary command execution due to improper input validation
2018-10-18 19:24:26
Bypassing OGNL sandboxes for fun and charities
2023-01-27 16:00:49
nuclei
nuclei
Apache Struts 2 - Remote Command Execution
2020-08-19 13:13:31
pentestit
pentestit
UPDATE: Infection Monkey 1.6.1
2018-12-03 22:28:53
JexBoss: Java Deserialization Verification & EXploitation Tool!
2017-08-11 06:52:45
talosblog
talosblog
2017 in Snort Signatures.
2018-01-29 11:37:00
Another Apache Struts Vulnerability Under Active Exploitation
2017-09-07 15:42:00
nmap
nmap
http-vuln-cve2017-5638 NSE Script
2017-03-10 17:53:45
ics
ics
Top 10 Routinely Exploited Vulnerabilities
2020-05-12 12:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - July 2017
2018-03-20 00:00:00
Oracle Critical Patch Update Advisory - April 2017
2017-04-18 00:00:00
10 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
Related for 02304D05D897B568E77C8953094F5914F389089362655D2AB68B096E3F3418DC