The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
apache struts 2.3.1 |
||
apache struts 2.3.1.1 |
||
apache struts 2.3.1.2 |
||
apache struts 2.3.3 |
||
apache struts 2.3.4 |
||
apache struts 2.3.4.1 |
||
apache struts 2.3.7 |
||
apache struts 2.3.8 |
||
apache struts 2.3.12 |
||
apache struts 2.3.14 |
||
apache struts 2.3.14.1 |
||
apache struts 2.3.14.2 |
||
apache struts 2.3.14.3 |
||
apache struts 2.3.15 |
||
apache struts 2.3.15.1 |
||
apache struts 2.3.15.2 |
||
apache struts 2.3.15.3 |
||
apache struts 2.3.16 |
||
apache struts 2.3.16.1 |
||
apache struts 2.3.16.2 |
||
apache struts 2.3.16.3 |
||
apache struts 2.3.20 |
||
apache struts 2.3.20.1 |
||
apache struts 2.3.20.3 |
||
apache struts 2.3.24 |
||
apache struts 2.3.24.1 |
||
apache struts 2.3.24.3 |
||
apache struts 2.3.28 |
||
apache struts 2.3.28.1 |
||
apache struts 2.3.29 |
||
apache struts 2.3.30 |
||
apache struts 2.3.31 |
||
apache struts 2.3.32 |
Big Red issues out-of-band patch for Apache and a few other urgent issues
Oracle has stepped outside its usual quarterly security fix cycle to address the latest Apache Struts 2 vulnerability. Ever since it emerged at the start of September, CVE-2017-9805 has been (in the words of a former Australian prime minister) “a shiver looking for a spine to crawl up”, because so many vendors use Apache to build Web interfaces and bake Struts 2 into their their Web application framework. Big Red's sprawling product set meant fixes had to be deployed across more than 20 prod...