org.apache.struts:struts2-apps (2.5-beta1), org.apache.struts:struts2-assembly (2.5-beta1) +33 more potentially affected by CVE-2024-53677 via org.apache.struts:struts2-core (2.5-beta1)

org.apache.struts:struts2-core MAVEN version 2.5-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.struts:struts2-core and may be impacted: - org.apache.struts:struts2-apps 2.5-beta1 - org.apache.struts:struts2-assembly 2.5-beta1 -...

org.apache.struts:struts2-apps (2.3.30), org.apache.struts:struts2-assembly (2.3.30) +40 more potentially affected by CVE-2024-53677 via org.apache.struts:struts2-core (2.3.30)

org.apache.struts:struts2-core MAVEN version 2.3.30 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.struts:struts2-core and may be impacted: - org.apache.struts:struts2-apps 2.3.30 - org.apache.struts:struts2-assembly 2.3.30 -...

com.amazonaws.serverless:aws-serverless-java-container-struts (>=1.9, <=1.9.5), com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=4.0.2, <=5.0.3) +53 more potentially affected by CVE-2024-53677 via org.apache.struts:struts2-core (>=6.0.0, <=6.3.0.2)

org.apache.struts:struts2-core MAVEN version =6.0.0, =1.9, =4.0.2, =4.0.2, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =1.4.0, =1.4.1, =1.4.0, =1.4.3 and more Source cves: CVE-2024-53677 Source advisory: OSV:GHSA-43...

org.apache.struts:struts2-apps (2.3.14), org.apache.struts:struts2-assembly (2.3.14) +40 more potentially affected by CVE-2024-53677 via org.apache.struts:struts2-core (2.3.14)

org.apache.struts:struts2-core MAVEN version 2.3.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.struts:struts2-core and may be impacted: - org.apache.struts:struts2-apps 2.3.14 - org.apache.struts:struts2-assembly 2.3.14 -...

org.anyline:anyline-struts (>=8.3.7, <=8.3.8), org.apache.struts:struts2-apps (2.3.35) +40 more potentially affected by CVE-2024-53677 via org.apache.struts:struts2-core (2.3.35)

org.apache.struts:struts2-core MAVEN version 2.3.35 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.struts:struts2-core and may be impacted: - org.anyline:anyline-struts =8.3.7, =8.3.8 - org.apache.struts:struts2-apps 2.3.35 -...

com.github.vencent-lu:giants-web-struts2 (>=1.1.2, <=1.1.8), org.apache.struts:struts2-apps (2.3.34) +40 more potentially affected by CVE-2024-53677 via org.apache.struts:struts2-core (2.3.34)

org.apache.struts:struts2-core MAVEN version 2.3.34 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.struts:struts2-core and may be impacted: - com.github.vencent-lu:giants-web-struts2 =1.1.2, =1.1.8 - org.apache.struts:struts2-apps 2.3.34 -...

org.apache.struts:struts2-apps (2.5.32), org.apache.struts:struts2-assembly (2.5.32) +53 more potentially affected by CVE-2024-53677 via org.apache.struts:struts2-core (2.5.32)

org.apache.struts:struts2-core MAVEN version 2.5.32 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.struts:struts2-core and may be impacted: - org.apache.struts:struts2-apps 2.5.32 - org.apache.struts:struts2-assembly 2.5.32 -...

org.apache.struts:struts2-apps (2.0.8), org.apache.struts:struts2-blank (2.0.8) +16 more potentially affected by CVE-2024-53677 via org.apache.struts:struts2-core (2.0.8)

org.apache.struts:struts2-core MAVEN version 2.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.struts:struts2-core and may be impacted: - org.apache.struts:struts2-apps 2.0.8 - org.apache.struts:struts2-blank 2.0.8 -...

com.amashchenko.struts2.actionflow:struts2-actionflow-plugin (2.3.4), com.amashchenko.struts2.actionflow:struts2-actionflow-showcase (2.3.4) +108 more potentially affected by CVE-2024-53677 via org.apache.struts:struts2-core (2.3.16.3)

org.apache.struts:struts2-core MAVEN version 2.3.16.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.struts:struts2-core and may be impacted: - com.amashchenko.struts2.actionflow:struts2-actionflow-plugin 2.3.4 -...

com.amazonaws.serverless:aws-serverless-java-container-struts (>=1.9, <=1.9.5), com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=4.0.2, <=5.0.3) +53 more potentially affected by CVE-2024-53677 via org.apache.struts:struts2-core (>=6.0.0, <=6.3.0.2)

org.apache.struts:struts2-core MAVEN version =6.0.0, =1.9, =4.0.2, =4.0.2, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =1.4.0, =1.4.1, =1.4.0, =1.4.3 and more Source cves: CVE-2024-53677 Source advisory: GHSA-43MQ-6...

CVE-2024-53677

File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before...

CVE-2024-53677 Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before...

CVE-2024-53677 Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before...

CVE-2024-53677 Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before...

CVE-2024-53677

File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before...

CVE-2024-53677

A flaw in the file upload logic of Apache Struts (versions 2.0.0 to before 6.4.0) allows an unauthenticated attacker to manipulate file upload parameters to enable path traversal . This can result in the upload of a malicious file, potentially leading to Remote Code Execution (RCE) . The vulnerab...

Apache Struts security vulnerabilities

Apache Struts is the United States Apache Apache Foundation, an open source project , is a set of open source MVC framework for creating enterprise-class Java Web applications , mainly provides two versions of the framework products , Struts 1 and Struts 2. Apache Struts has a file upload...

CVE-2024-53677: Unrestricted Upload of File with Dangerous Type

File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before...

PT-2024-9392

Vulnerability Summary Name of the Vulnerable Software and Affected Versions: Apache Struts versions 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, and 6.0.0 through 6.3.0.2. Description A critical flaw exists in the file upload logic of Apache Struts. An attacker can manipulate file upload parameter...

CVE-2023-51644

Allegra SiteConfigAction Improper Access Control Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...