Apache Struts ParametersInterceptor Remote Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Apache Struts ParametersInterceptor...

Apache Struts ParametersInterceptor Remote Code Execution

This Metasploit module exploits a remote command execution vulnerability in Apache Struts versions 'Apache Struts ParametersInterceptor Remote Code Execution', 'Description' = %q This module exploits a remote command execution vulnerability in Apache Struts versions 2.3.1.2. This issue is caused...

The number of silver online the Struts command execution vulnerability, the total station the fall-vulnerability warning-the black bar safety net

Vulnerability Title: The number of silver online the Struts command execution vulnerability, the whole Station fall Vulnerability type: command execution Harm level: high Brief description: The number of silver online some address the presence of the Struts command execution vulnerability...

CVE-2012-4386

The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery CSRF attacks by setting the token name configuration parameter to a session attribute...

CVE-2012-4387

Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service CPU consumption via a long parameter name, which is processed as an OGNL expression...

Cross site request forgery (csrf)

The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery CSRF attacks by setting the token name configuration parameter to a session attribute...

CVE-2012-4386

The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery CSRF attacks by setting the token name configuration parameter to a session attribute...

Code injection

Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service CPU consumption via a long parameter name, which is processed as an OGNL expression...

CVE-2012-4387

Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service CPU consumption via a long parameter name, which is processed as an OGNL expression...

CVE-2012-4387

Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service CPU consumption via a long parameter name, which is processed as an OGNL expression...

CVE-2012-4386

CVE-2012-4386 affects Apache Struts 2.x (2.0.0–2.3.4). The token check mechanism fails to validate the token name configuration parameter, enabling CSRF by setting the token name to a session attribute. Impact described in sources: cross-site request forgery with potential unauthorized actions wh...

CVE-2012-4386

The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery CSRF attacks by setting the token name configuration parameter to a session attribute...

CVE-2012-4387

CVE-2012-4387 is an Apache Struts DoS vulnerability: remote attacker can cause CPU exhaustion by sending a long parameter name that is processed as an OGNL expression. The issue affects Struts 2.0.0–2.3.4. In the connected IBM advisories, remediation centers on upgrading IBM Sterling Order Manage...

EUVD-2022-4209

Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service CPU consumption via a long parameter name, which is processed as an OGNL expression...

Apache Group Struts 2.x跨站请求伪造和拒绝服务漏洞

Apache Struts是一款开发Java web应用程序的开源Web应用框架。 Apache Struts 2.3.4.1之前版本存在安全漏洞，可被恶意用户利用执行跨站请求伪造和拒绝服务攻击。 1）令牌处理机制没有正确验证令牌名称配置参数，通过操作令牌值参数为会话属性值，该漏洞可被利用执行跨站请求伪造攻击。 2）在处理请求参数时的错误可被利用消耗CPU资源，通过包含OGNL表达式的参数名称可造成拒绝服务。 0 Apache Group Struts 2.x 厂商补丁： Apache Group ------------ Apache...

VMSA-2012-0013 VMware vSphere and vCOps updates to third party libraries.

The remote ESXi is missing one or more security related Updates from VMSA-2012-0013. Summary VMware has updated several third party libraries in vSphere and vcOps to address multiple security vulnerabilities. Relevant releases VMware vCenter 4.1 without Update 3 VMware vCenter Update Manager 4.1...

Apache Struts Security Update (S2-012) - Active Check

Apache Struts is prone to a java method execution vulnerability. Copyright C 2012 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

VMSA-2012-0013 : VMware vSphere and vCOps updates to third-party libraries

a. vCenter and ESX update to JRE 1.6.0 Update 31 The Oracle Sun JRE is updated to version 1.6.031, which addresses multiple security issues. Oracle has documented the CVE identifiers that are addressed by this update in the Oracle Java SE Critical Patch Update Advisory of February 2012. b. vCente...

Apache Struts 2 ConversionErrorInterceptor Java Injection

Added: 08/02/2012 CVE: CVE-2012-0391 OSVDB: 78277 Background Apache Struts is an open-source web application framework for developing Java EE web applications. It uses and extends the Java Servlet API to encourage developers to adopt a model-view-controller MVC architecture. Problem Struts uses...

Apache Struts 2 ConversionErrorInterceptor Java Injection

Added: 08/02/2012 CVE: CVE-2012-0391 OSVDB: 78277 Background Apache Struts is an open-source web application framework for developing Java EE web applications. It uses and extends the Java Servlet API to encourage developers to adopt a model-view-controller MVC architecture. Problem Struts uses...