CVE-2024-53677

Published Dec 11, 2024

Last updated a day ago

CVSS critical 9.5

Overview

Description
File upload logic is flawed vulnerability in Apache Struts. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0, which fixes the issue. You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067
Source
security@apache.org
NVD status
Received

Risk scores

CVSS 4.0

Type
Secondary
Base score
9.5
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:C/RE:L/U:Red
Severity
CRITICAL

Social media

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score

2

  1. 🚨🚨CVE-2024-53677 (CVSS: 9.5) : Critical Vulnerability in Apache Struts Allows Remote Code Execution ⚠️An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform… h

    @zoomeye_team

    12 Dec 2024

    25 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. [CVE-2024-53677: CRITICAL] Flaw in Apache Struts file upload logic leaves systems vulnerable. Upgrade to version 6.4.0 to fix. Details at https://t.co/p1EItRhWL8 https://t.co/0hwNRaEEHe https://t.co/reGW7YshKY

    @CveFindCom

    11 Dec 2024

    176 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. Struts 2でパストラバーサルに起因してRCEにつながる恐れのある脆弱性。FileUploadInterceptorを使用していない場合は影響なし。S2-066（CVE-2023-50164）と同様の問題とのこと。 CVE-2024-53677 S2-067 - Apache Struts 2 Wiki - Apache Software Foundation https://t.co/VTXVY3EFe3

    @autumn_good_35

    11 Dec 2024

    1095 Impressions

    5 Retweets

    6 Likes

    5 Bookmarks

    0 Replies

    0 Quotes

  4. 同僚が報告したCVE-2024-53677 S2-067の情報が出ました https://t.co/Y9HGVvLthS

    @kinyuka

    11 Dec 2024

    3367 Impressions

    10 Retweets

    25 Likes

    8 Bookmarks

    2 Replies

    0 Quotes

  5. SIOSセキュリティブログを更新しました。 Strutsの脆弱性(Critical: CVE-2024-53677) #sios_tech #security #vulnerability #セキュリティ #struts https://t.co/fECBPNFAI9

    @omokazuki

    11 Dec 2024

    24 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. CVE-2024-53677 File upload logic is flawed! Please read the announcement https://t.co/D2yXIyqFMv #struts #security #vulnerability

    @TheApacheStruts

    11 Dec 2024

    26 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    1 Quote

References