Heist/ feed

Security feed

advisoryCISA Known Exploited Vulnerabilities

Apache Struts Remote Code Execution Vulnerability

Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace. Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace. CISA required action: Apply updates per vendor instructions.

StrutsCVE-2018-11776
Structured advisory · Revision 1Original source
Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2018-11776

Struts

Source reference: /product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record
Related CVEs
CVE-2018-11776

Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event
#2990 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
advisoryCISA Known Exploited Vulnerabilities

Apache Struts Remote Code Execution Vulnerability

Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution. CISA required action: Apply updates per vendor instructions.

StrutsCVE-2017-5638
Structured advisory · Revision 1Original source
Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2017-5638

Struts

Source reference: /product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record
Related CVEs
CVE-2017-5638

Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event
#2989 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
advisoryCISA Known Exploited Vulnerabilities

Apache Struts Remote Code Execution Vulnerability

Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution. CISA required action: Apply updates per vendor instructions.

StrutsCVE-2020-17530
Structured advisory · Revision 1Original source
Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2020-17530

Struts

Source reference: /product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record
Related CVEs
CVE-2020-17530

Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event
#2987 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
advisoryCISA Known Exploited Vulnerabilities

Apache Struts Deserialization of Untrusted Data Vulnerability

Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads. CISA required action: Apply updates per vendor instructions.

StrutsCVE-2017-9805
Structured advisory · Revision 1Original source
Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2017-9805

Struts

Source reference: /product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record
Related CVEs
CVE-2017-9805

Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event
#2982 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
advisoryCISA Known Exploited Vulnerabilities

Apache Struts Improper Input Validation Vulnerability

Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions. CISA required action: Apply updates per vendor instructions.

StrutsCVE-2013-2251
Structured advisory · Revision 1Original source
Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2013-2251

Struts

Source reference: /product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record
Related CVEs
CVE-2013-2251

Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event
#2742 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
advisoryCISA Known Exploited Vulnerabilities

Apache Struts Command Injection Vulnerability

Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

StrutsCVE-2016-3081
Structured advisory · Revision 1Original source
Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2016-3081

Struts

Source reference: /product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record
Related CVEs
CVE-2016-3081

Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event
#19 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement