PT-2012-1251 · Apache · Apache Struts

Jack Hagan

·

Publicado

2012-03-22

·

Atualizado

2023-02-13

·

CVE-2012-1592

CVSS v2.0

9.0

Alta

VetorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Apache Struts versions prior to 2.5.22
Description The issue is related to a local code execution problem in Apache Struts2 when processing malformed XSLT files. This could allow a malicious user to upload and execute arbitrary files by sending a specially crafted XSLT file. The exploitation of this issue may enable a remote attacker to execute arbitrary code.
Recommendations For versions prior to 2.5.22, update to version 2.5.22 or later to resolve the issue. As a temporary workaround, consider restricting the upload of XSLT files or disabling the processing of malformed XSLT files until a patch is applied.

Exploit

Correção

Unrestricted File Upload

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

BDU:2024-08708
CVE-2012-1592
GHSA-8M5Q-CRQQ-6PMF

Produtos afetados

Apache Struts