9.8
Critique
Exploitée
· rançongiciel
CVE-2017-5638 Apache Struts Remote Code Execution Vulnerability
Exploitation active constatée
· catalogue CISA KEV
Action attendue
Apply updates per vendor instructions.
Campagnes de rançongiciel
Utilisation connue
Faiblesse
CWE-20
Description
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Struts | Versions non publiées |
Références
- nmap.org nmap.org
- www.arubanetworks.com www.arubanetworks.com
- arstechnica.com arstechnica.com
- 41570 exploit-db.com
- security.netapp.com security.netapp.com
- github.com github.com
- struts.apache.org struts.apache.org
- blog.talosintelligence.com blog.talosintelligence.com
- www.imperva.com www.imperva.com
- h20566.www2.hpe.com h20566.www2.hpe.com
- VU#834067 www.kb.cert.org
- isc.sans.edu isc.sans.edu
- struts.apache.org struts.apache.org
- 1037973 www.securitytracker.com
- www.eweek.com www.eweek.com
- 96729 www.securityfocus.com
- twitter.com twitter.com
- github.com github.com
- packetstormsecurity.com packetstormsecurity.com
- www.symantec.com www.symantec.com
- support.lenovo.com support.lenovo.com
- git1-us-west.apache.org git1-us-west.apache.org
- h20566.www2.hpe.com h20566.www2.hpe.com
- git1-us-west.apache.org git1-us-west.apache.org
- cwiki.apache.org cwiki.apache.org
- 41614 www.exploit-db.com
- cwiki.apache.org cwiki.apache.org
- www.oracle.com www.oracle.com
- h20566.www2.hpe.com h20566.www2.hpe.com
- blog.trendmicro.com blog.trendmicro.com
- [announce] 20200131 Apache Software Foundation Security Report: 2019 lists.apache.org
- [announce] 20210125 Apache Software Foundation Security Report: 2020 lists.apache.org
- [announce] 20210223 Re: Apache Software Foundation Security Report: 2020 lists.apache.org
Chronologie
- Publiée
- Ajoutée au catalogue KEV
- Dernière modification
Autres CVE de Apache Struts
Les 33 CVE de Apache Struts →
CVE-2026-104714
Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache…
Non notée
CVE-2026-104713
Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin
Non notée
CVE-2026-104712
Asymmetric resource consumption (amplification) vulnerability in Apache Struts
Non notée
CVE-2026-104711
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection')…
Non notée