Description

An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.

Remediation

References

https://cwiki.apache.org/confluence/display/ww/s2-060

https://launchpad.support.sap.com/#/notes/2982840

https://www.oracle.com/security-alerts/cpuApr2021.html

https://www.oracle.com/security-alerts/cpujan2021.html

https://www.oracle.com/security-alerts/cpuoct2021.html

Related Vulnerabilities

CVE-2018-16131 Vulnerability in maven package com.typesafe.akka:akka-http-core_2.11

CVE-2021-23331 Vulnerability in maven package com.squareup:connect

CVE-2022-25898 Vulnerability in maven package org.webjars.bowergithub.kjur:jsrsasign

CVE-2015-5349 Vulnerability in maven package org.apache.directory.studio:org.apache.directory.studio.ldapbrowser.core

CVE-2017-1000106 Vulnerability in maven package io.jenkins.blueocean:blueocean-bitbucket-pipeline

Severity

High

Classification

CWE-281 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Vendor Advisory Permissions Required Third Party Advisory Patch