Proof-of-concept code published for Apache Struts vulnerability

By

Cisco first third-party vendor to announce response.

A critical vulnerability in Apache Struts could have widespread downstream impacts on vendors that use the framework to build web apps like configuration interfaces.

Proof-of-concept code published for Apache Struts vulnerability

The remote code execution bug, CVE-2023-50164, was discovered by Steven Seeley of Source Incite, who yesterday posted on X that proof-of-concept code exists for it.

Apache's advisory states that all Struts developers and users need to upgrade to Struts 2.5.33, 6.3.0.2 or higher releases.

“An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file”, the advisory stated.

It affects three branches of the framework: end-of-life versions from 2.0.0 to 2.3.37; 2.5 to 2.5.32, and 6.0.0 to 6.3.0.

The bug is already having downstream impacts, with networking vendor Cisco first to announce its response.

In an interim advisory, Cisco announced it is investigating which of its products may be impacted.

So far, 27 products are under investigation in Cisco’s collaboration and social media software; network and content security devices; network management and provisioning systems; and voice and unified communications devices.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © iTnews.com.au . All rights reserved.
Tags:

Most Read Articles

Eagers Automotive finds unauthorised access to parts of IT systems

Eagers Automotive finds unauthorised access to parts of IT systems

Hackers hit Victoria's court recording database

Hackers hit Victoria's court recording database

St Vincent's Health Australia warns cyber attack forensics could "take some time"

St Vincent's Health Australia warns cyber attack forensics could "take some time"

Yakult Australia confirms cyber incident

Yakult Australia confirms cyber incident

Log In

  |  Forgot your password?