CVE-2023-50164 is a critical security vulnerability affecting certain versions of Apache Struts software. This vulnerability allows an attacker to manipulate file upload parameters, enabling path traversal and potentially leading to the uploading of malicious files and remote code execution. Systems running Apache Struts versions 2.0.0 to 2.5.33 and 6.0.0 to 6.3.0.2 are at risk. To mitigate this issue, users are advised to upgrade to the latest versions of the software.

How do I know if I'm affected?

If you're using Apache Struts software, you might be affected by the vulnerability. This issue impacts Apache Struts versions 2.0.0 to 2.5.33 and 6.0.0 to 6.3.0.2. The vulnerability allows attackers to manipulate file upload parameters, enabling path traversal and potentially leading to the uploading of malicious files and remote code execution. To check if you're affected, verify the version of Apache Struts you're using. If it falls within the mentioned version ranges, you should consider upgrading to a newer, secure version.

What should I do if I'm affected?

If you're affected by the vulnerability, follow these simple steps. Identify the version of Apache Struts you're using. If it's within the affected range (2.0.0 to 2.5.33 or 6.0.0 to 6.3.0.2), upgrade to a secure version (2.5.33 or 6.3.0.2 or higher). This should help protect your system from potential attacks.

Is CVE-2023-50164 in CISA’s Known Exploited Vulnerabilities Catalog?

CVE-2023-50164 is not listed in CISA's Known Exploited Vulnerabilities Catalog. This critical vulnerability, affecting certain Apache Struts versions, allows attackers to manipulate file upload parameters, potentially leading to path traversal and remote code execution. To address this issue, users should upgrade to Apache Struts versions 2.5.33 or 6.3.0.2 or higher.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-552, which involves a directory traversal vulnerability in Apache Struts' file upload component, potentially leading to remote code execution.

For more details

CVE-2023-50164 is a critical vulnerability in Apache Struts that could lead to path traversal and remote code execution. Users are advised to upgrade to Struts 2.5.33 or 6.3.0.2 or higher to mitigate the risk. For a comprehensive understanding of this vulnerability, consult the NVD page and the resources listed below.

• Packet Storm: Struts S2-066 File Upload Remote Code Execution

• Apache Mail Archives: Apache Struts 6.3.0.2 & 2.5.33 Announcement

• NetApp Product Security: CVE-2023-50164 Apache Struts Vulnerability in NetApp Products

• Open Source Software Security: CVE-2023-50164 Apache Struts Directory Traversal Vulnerability