PoC Exploit Targeting Apache Struts Surfaces on GitHub

🗓️ 14 Aug 2020 21:20:01Reported by Tom SpringType

Proof-of-concept exploit targeting Apache Struts bugs surfaced, impacting versions 2.0.0 through 2.5.20, potentially allowing remote code-execution and denial-of-service attacks on vulnerable installations

Reporter	Title	Published	Views	Family All 487
IBM Security Bulletins	Security Bulletin: A vulnerability in Apache Struts 2 affects IBM Platform Symphony and IBM Spectrum Symphony (CVE-2017-5638)	18 Jun 201801:35	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in Apache Struts affects Storwize V7000 Unified (CVE-2017-5638)	18 Jun 201800:34	–	ibm
IBM Security Bulletins	Security Bulletin: Order Management could be subject to an Apache Struts vulnerability that could allow a remote attacker to execute arbitrary code on the system.	12 Apr 202417:44	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Struts (Publicly disclosed vulnerability) affects Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections	28 Oct 202019:21	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Struts (Publicly disclosed vulnerability) affects Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections	4 Nov 202009:04	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Struts affect IBM Tivoli Application Dependency Discovery Manager.	13 Apr 202113:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Call Center and Apache Struts Struts upgrade strategy (various CVEs, see below)	14 Sep 202217:37	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Struts (Publicly disclosed vulnerability) affects Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections	28 Oct 202019:08	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Struts v2 Jakarta Multipart parser code execution affects IBM Platform Cluster Manager Standard Edition, IBM Platform Cluster Manager Advanced Edition, Platform HPC, and Spectrum Cluster Foundation (CVE-2017-5638)	18 Jun 201801:35	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Struts affects IBM Social Media Analytics (CVE-2017-5638)	15 Jun 201822:50	–	ibm

Source	Link
cwiki	www.cwiki.apache.org/confluence/display/WW/S2-059
cwiki	www.cwiki.apache.org/confluence/display/WW/S2-060
threatpost	www.threatpost.com/newsletter-sign/
threatpost	www.threatpost.com/equi-facts-equifax-clarifies-the-numbers-for-its-massive-breach/131797/
threatpost	www.threatpost.com/equi-facts-equifax-clarifies-the-numbers-for-its-massive-breach/131797/
threatpost	www.threatpost.com/equifax-confirms-march-struts-vulnerability-behind-breach/127975/
github	www.github.com/cellanu/cve-2019-0230
cwiki	www.cwiki.apache.org/confluence/display/WW/S2-060
threatpost	www.threatpost.com/ebooks/2020-in-security-four-stories-from-the-new-threat-landscape/
threatpost	www.threatpost.com/ebooks/2020-in-security-four-stories-from-the-new-threat-landscape/

14 Aug 2020 21:20Current

9.5High risk

Vulners AI Score9.5

EPSS0.99999