A vulnerability in Apache Struts could allow an unauthenticated, remote malicious user to execute arbitrary code on a targeted system. The vulnerability exists because the affected software insufficiently validates user-supplied input, allowing the use of results with no namespace value and the use of url tags with no value or action. In cases where upper actions or configurations also have no namespace or a wildcard namespace, an attacker could exploit this vulnerability by sending a request that submits malicious input to the affected application for processing. If successful, the attacker could execute arbitrary code in the security context of the affected application on the targeted system. The following Snort rules can be used to detect possible exploitation of this vulnerability: Snort SID 29639, 39190, 39191, and 47634 This advisory is available at the following link: tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180823-apache-struts
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
apache struts |
And you'll definitely want to check out the libssh flaw
Oracle has released a wide-ranging security update to address more than 300 CVE-listed vulnerabilities in its various enterprise products. The October release covers the gamut of Oracle's offerings, including its flagship Database, E-Business Suite, and Fusion Middleware packages. For Database, the update addresses a total of three flaws. Two of the vulnerabilities (CVE-2018-3259 and CVE-2018-3299) can be remotely exploited without authentication, while the third, CVE-2018-7489, would require th...
Underground forums alight with Struts chat, we hear Apache's latest SNAFU – Struts normal, all fscked up: Web app framework needs urgent patching Equifax's disastrous Struts patching blunder: THOUSANDS of other orgs did it too
A recently uncovered critical vulnerability in Apache Struts is already being exploited in the wild. Threat intel firm Volexity has warned that hackers are abusing the CVE-2018-11776 vuln to attack systems running Apache Struts 2, a popular open-source framework for developing applications in Java. Specifically, some nasty characters have abused the flaw while trying to install the CNRig cryptocurrency miner, researchers said. The vulnerability appears to be easier to exploit than the Struts fla...
Paging Equifax: Time to update again, fellas
Another critical security hole has been found in Apache Struts 2, requiring an immediate update. The vulnerability – CVE-2018-11776 – affects core code and allows miscreants to pull off remote code execution against vulnerable servers and websites. It affects all versions of Struts 2, the popular open-source framework for Java web apps. The Apache Software Foundation has "urgently advised" anyone using Struts to update to the latest version immediately, noting that the last time a critical h...