Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Apache Struts Path traversal (S2-067/CVE-2024-53677, S2-066/CVE-2023-50164) - Vulnerability Database

Apache Struts Path traversal (S2-067/CVE-2024-53677, S2-066/CVE-2023-50164)

Description

The file upload mechanism in Apache Struts contains a vulnerability. An attacker can exploit this by manipulating file upload parameters to perform path traversal, potentially allowing the upload of a malicious file. Under certain conditions, this can lead to Remote Code Execution (RCE)

Remediation

Upgrade at least to Struts 6.4.0 (or the latest version) and migrate to the new file upload mechanism.

References

S2-067
S2-066

Related Vulnerabilities

Sitecore XM/XP Insecure Deserialization (CVE-2025-27218) Critical
Common tags: Code Execution Known Vulnerabilities
Ektron CMS multiple vulnerabilities High
Common tags: Code Execution Known Vulnerabilities
Remote Unauthenticated Code Execution Vulnerability in OpenSSH server (CVE-2024-6387) High
Common tags: Code Execution Known Vulnerabilities
Ruby on Rails DoubleTap RCE (CVE-2019-5420) High
Common tags: Code Execution Known Vulnerabilities
Nginx stack-based buffer overflow High
Common tags: Code Execution Known Vulnerabilities

Severity

Critical

Classification

CVE-2024-53677
CVE-2023-50164
CWE-434
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Tags

Code Execution
Path Traversal
Known Vulnerabilities