CVE-2023-50164

—

CVSS 3.1

9.8 critical

EPSS

81%p100

Published

Dec 7, 2023 (Dec 7, 2023)

Modified

Jun 17, 2026

Description

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Vendors: apache
Products: struts
Weakness: CWE-552
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (80.8%)

In the news10 stories

Security Affairs newsletter Round 503 by Pierluigi Paganini

Security AffairsDec 22, 14:59 UTC · Dec 22, 2024Ransomware CVE-2024-53677 CVE-2023-50164

Patch Alert: Critical Apache Struts Flaw Found, Exploitation Attempts Detected

The Hacker NewsDec 21, 08:59 UTC · Dec 21, 2024Vulnerability in the wildCVE-2024-53677 CVE-2023-50164

Attackers are trying to exploit Apache Struts vulnerability (CVE-2023-50164)

Help Net SecurityDec 18, 09:23 UTC · Dec 18, 2023Vulnerability in the wildCVE-2023-50164

New Critical RCE Vulnerability Discovered in Apache Struts 2

The Hacker NewsDec 18, 04:47 UTC · Dec 18, 2023Vulnerability in the wildCVE-2023-50164 CVE-2017-5638

Week in review: Apache Struts vulnerability exploit attempt, EOL Sophos firewalls get hotfix

Help Net SecurityDec 17, 00:00 UTC · Dec 17, 2023Vulnerability in the wildCVE-2022-3236 CVE-2023-50164 CVE-2021-44228+1 CVEs

Apache fixed Critical RCE flaw CVE-2023

Security AffairsDec 11, 15:08 UTC · Dec 11, 2023Vulnerability in the wildCVE-2023-50164

Threat actors are attempting to exploit Apache Struts vulnerability CVE-2024

Security AffairsDec 18, 20:26 UTC · Dec 18, 2024Vulnerability CVE-2024-53677 CVE-2023-50164