Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBMD27FF7B57344B183496D83F6578C8492E06DFE16CB53278348BCD1FE738520A5
HistoryMay 01, 2024 - 9:28 a.m.

Security Bulletin: A vulnerability in Apache Struts affects IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products

2024-05-0109:28:35
www.ibm.com
6
apache struts
ibm san volume controller
ibm storwize
ibm spectrum virtualize
ibm flashsystem
code execution
file upload
cvss 9.8

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.093 Low

EPSS

Percentile

94.7%

JSON

Summary

A vulnerability in Apache Struts affects the product’s management GUI. The Command Line Interface is unaffected (CVE-2023-50164). This bulletin identifies the steps to take to address the vulnerability.

Vulnerability Details

CVEID:CVE-2023-50164
**DESCRIPTION:**Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by the handling of file upload parameters, which, if manipulated, can lead to unauthorized path traversal. By uploading a specially crafted archive file containing “dot dot” sequences (/…/), an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/273374 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Storage Virtualize 8.4

Remediation/Fixes

IBM recommends that you fix this vulnerability by upgrading affected versions of IBM SAN Volume Controller, IBM Storwize V7000, IBM Storwize V5000 and V5100, IBM Storwize V5000E, IBM Spectrum Virtualize Software, IBM Spectrum Virtualize for Public Cloud, IBM FlashSystem V9000, IBM FlashSystem 9500, IBM FlashSystem 9100 Family, IBM FlashSystem 9200, IBM FlashSystem 7300, IBM FlashSystem 7200, IBM FlashSystem 5200 and IBM FlashSystem 5000 to the following code levels or higher:

8.6.2.0

8.6.0.2

8.5.0.10

8.4.0.13

Latest IBM SAN Volume Controller Code
Latest IBM Storwize V7000 Code
Latest IBM Storwize V5000 and V5100 Code
Latest IBM Storwize V5000E Code
Latest IBM FlashSystem V9000 Code
Latest IBM FlashSystem 9500 Code
Latest IBM FlashSystem 9100 Family Code
Latest IBM FlashSystem 9200 Code
Latest IBM FlashSystem 7300 Code
Latest IBM FlashSystem 7200 Code
Latest IBM FlashSystem 5000 and 5200 Code
Latest IBM Spectrum Virtualize Software
Latest IBM Spectrum Virtualize for Public Cloud

Workarounds and Mitigations

None

Related

nessus 4
saint 2
ibm 7
githubexploit 9
qualysblog 4
hivepro 1
cve 1
srcincite 2
malwarebytes 2
cnvd 1
akamaiblog 1
f5 1
osv 2
openvas 1
adobe 1
github 1
veracode 1
cisco 1
ubuntucve 1
trendmicroblog 1
prion 1
redhatcve 1
impervablog 1
thn 1
avleonov 1
oracle 1
nessus
nessus
Adobe Experience Manager 6.0.0.0 < 6.5.19.1 Arbitrary code execution (APSB23-77)
2024-01-07 00:00:00
Apache Struts 2.5.0 < 2.5.33 / 6.0.0 < 6.3.0.2 Remote Code Execution (S2-066)
2023-12-07 00:00:00
Cisco Identity Services Engine RCE (cisco-sa-struts-C2kCMkmT)
2023-12-21 00:00:00
saint
saint
Apache Struts file upload directory traversal
2023-12-20 00:00:00
Apache Struts file upload directory traversal
2023-12-20 00:00:00
ibm
ibm
Security Bulletin: Vulnerabilities in Apache Struts library affect Tivoli Netcool/OMNIbus WebGUI (CVE-2023-50164)
2024-01-17 03:00:38
Security Bulletin: Struts Vulnerability - Order Management does contain the Struts code and it is vulnerable with lower risk [CVE-2023-50164]
2024-02-07 22:18:44
Security Bulletin: Due to use of Apache Struts, Netcool Operation Insight is vulnerable to arbitrary code execution.
2024-05-03 11:02:53
githubexploit
githubexploit
Exploit for Files or Directories Accessible to External Parties in Apache Struts
2023-12-17 14:18:54
Exploit for Files or Directories Accessible to External Parties in Apache Struts
2023-12-13 09:31:36
Exploit for Files or Directories Accessible to External Parties in Apache Struts
2023-12-20 08:46:19
qualysblog
qualysblog
Detect and Manage the Risk of Apache Struts (CVE-2023-50164) Comprehensively
2024-01-12 22:44:26
Announcing TotalCloud™ 2.0 with TruRisk™ Insights: The Future of Cloud and SaaS Security
2024-02-07 13:55:00
Yet Another Apache Struts 2 Vulnerability – CVE-2023-50164
2023-12-26 14:06:14
hivepro
hivepro
Critical Remote Code Execution Flaw Uncovered in Apache Struts 2
2023-12-15 06:56:04
cve
cve
CVE-2023-50164
2023-12-07 09:15:07
srcincite
srcincite
SRC-2024-0001 : Trackplus Allegra Service Desk Module UploadHelper upload Directory Traversal Remote Code Execution Vulnerability
2023-11-08 00:00:00
SRC-2023-0004 : Apache Struts Security Feature Bypass Remote Code Execution Vulnerability
2023-11-08 00:00:00
malwarebytes
malwarebytes
Recently-patched Apache Struts vulnerability used in worldwide attacks
2023-12-14 21:35:04
Microsoft patches 34 vulnerabilities, including one zero-day
2023-12-13 16:39:23
cnvd
cnvd
Apache Struts Directory Traversal Vulnerability
2023-12-12 00:00:00
akamaiblog
akamaiblog
Observed Exploitation Attempts of Struts 2 S2-066 Vulnerability (CVE-2023-50164)
2023-12-14 10:00:40
f5
f5
K000137931 : Apache Struts vulnerability CVE-2023-50164
2023-12-15 00:00:00
osv
osv
CVE-2023-50164
2023-12-07 09:15:07
Apache Struts vulnerable to path traversal
2023-12-07 09:30:45
openvas
openvas
Apache Struts Security Update (S2-066)
2023-12-08 00:00:00
adobe
adobe
APSB23-77 : Security update available for Adobe Experience Manager Forms
2023-12-15 00:00:00
github
github
Apache Struts vulnerable to path traversal
2023-12-07 09:30:45
veracode
veracode
Remote Code Execution (RCE)
2023-12-14 16:09:57
cisco
cisco
Apache Struts Vulnerability Affecting Cisco Products: December 2023
2023-12-12 16:00:00
ubuntucve
ubuntucve
CVE-2023-50164
2023-12-07 00:00:00
trendmicroblog
trendmicroblog
Decoding CVE-2023-50164: Unveiling the Apache Struts File Upload Exploit
2023-12-15 00:00:00
prion
prion
Design/Logic Flaw
2023-12-07 09:15:00
redhatcve
redhatcve
CVE-2023-50164
2023-12-11 06:27:16
impervablog
impervablog
CVE-2023-50164: A Critical Vulnerability in Apache Struts
2023-12-19 12:34:31
thn
thn
New Critical RCE Vulnerability Discovered in Apache Struts 2 - Patch Now
2023-12-12 05:23:00
avleonov
avleonov
November 2023 – January 2024: New Vulristics Features, 3 Months of Microsoft Patch Tuesdays and Linux Patch Wednesdays, Year 2023 in Review
2024-02-01 17:07:20
oracle
oracle
Oracle Critical Patch Update Advisory - January 2024
2024-01-16 00:00:00

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.093 Low

EPSS

Percentile

94.7%

JSON
Related for D27FF7B57344B183496D83F6578C8492E06DFE16CB53278348BCD1FE738520A5
nessus4saint2ibm7githubexploit9qualysblog4hivepro1cve1srcincite2malwarebytes2cnvd1akamaiblog1f51osv2openvas1adobe1github1veracode1cisco1ubuntucve1trendmicroblog1prion1redhatcve1impervablog1thn1avleonov1oracle1