CVE-2017-5638
CVSS 2.0 Score 10.0 of 10 (high)
Details
Summary
CVE-2017-5638 is a vulnerability in the Jakarta Multipart parser in Apache Struts 2 versions 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1. This vulnerability allows remote attackers to execute arbitrary commands by exploiting incorrect exception handling and error-message generation during file-upload attempts, using a crafted Content-Type, Content-Disposition, or Content-Length HTTP header with a #cmd= string. The vulnerability has been exploited in the wild in March 2017 and poses a high danger to organizations as it allows unauthorized execution of commands on affected systems. To remediate this vulnerability, organizations should update their Apache Struts framework to versions 2.3.32 or 2.5.10.1 or apply any necessary security patches provided by Apache Struts developers
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions