CRITICAL🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇵🇱 Wersja polska

CVE-2017-5638

CVSS 9.8v3.1pub. 2017-03-11upd. 2026-04-21

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Apache Struts

    APP
    Apache
    2.2.3 – 2.3.32 (excl.)2.5.0 – 2.5.10.1 (excl.)

  • Arubanetworks Clearpass Policy Manager

    APP
    Arubanetworks
    < 6.6.5

  • HP Server Automation

    APP
    Hp
    10.0.010.1.010.2.010.5.09.1.0

  • IBM Storwize V3500

    HW
    Ibm
    all versions

  • IBM Storwize V3500 Firmware

    OS
    Ibm
    7.7.1.67.8.1.0

  • IBM Storwize V5000

    HW
    Ibm
    all versions

  • IBM Storwize V5000 Firmware

    OS
    Ibm
    7.7.1.67.8.1.0

  • IBM Storwize V7000

    HW
    Ibm
    all versions

  • IBM Storwize V7000 Firmware

    OS
    Ibm
    7.7.1.67.8.1.0

  • Lenovo Storage V5030

    HW
    Lenovo
    all versions

  • Lenovo Storage V5030 Firmware

    OS
    Lenovo
    7.7.1.67.8.1.0

  • Netapp Oncommand Balance

    APP
    Netapp
    all versions

  • Oracle Weblogic Server

    APP
    Oracle
    10.3.6.0.012.1.3.0.012.2.1.1.012.2.1.2.0

CISA KEV — detailsi

Vendori
Apache ↗
Producti
Struts
Added to KEVi
November 3, 2021
Remediation deadline (US Federal)i
May 3, 2022(overdue)
Ransomwarei
Active ransomware campaigns exploit this vulnerability
Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
☠️WYKORZYSTYWANE W RANSOMWARE⏰CISA DEADLINE: 3 maja 2022
CWE
References

Related vulnerabilities

CVE-2022-22965CRITICAL9.8⚠ KEVPL ✓same product

Spring4Shell — RCE przez data binding w Spring MVC/WebFlux na JDK 9+

CVE-2020-17530CRITICAL9.8⚠ KEVPL ✓same product

RCE w Apache Struts 2 poprzez wymuszoną ewaluację OGNL

CVE-2020-14750CRITICAL9.8⚠ KEVPL ✓same product

Oracle WebLogic Server — Auth Bypass w komponencie Console (RCE)

CVE-2020-14882CRITICAL9.8⚠ KEVPL ✓same product

RCE bez uwierzytelnienia w konsoli Oracle WebLogic Server

CVE-2020-14644CRITICAL9.8⚠ KEVPL ✓same product

RCE w Oracle WebLogic Server — przejęcie serwera przez IIOP/T3