CVE-2023-50164

CVSS 3.1: 9.8 critical
EPSS: 81%p100
Published: Dec 7, 2023 · Dec 7, 2023
Modified: Jun 17, 2026

Analyze CVE-2023-50164 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Vendors: apache

Products: struts

Weakness: CWE-552

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (80.8%)

In the news

10 stories

Security Affairs newsletter Round 503 by Pierluigi Paganini

Security AffairsDec 22, 14:59 UTC · Dec 22, 2024RansomwareCVE-2024-53677 CVE-2023-501643 · 2 reads

Patch Alert: Critical Apache Struts Flaw Found, Exploitation Attempts Detected

The Hacker NewsDec 21, 08:59 UTC · Dec 21, 2024VulnerabilityExploitedCVE-2024-53677 CVE-2023-501642

Attackers are trying to exploit Apache Struts vulnerability (CVE-2023-50164)

Help Net SecurityDec 18, 09:23 UTC · Dec 18, 2023VulnerabilityExploitedCVE-2023-501642 · 1 read

New Critical RCE Vulnerability Discovered in Apache Struts 2

The Hacker NewsDec 18, 04:47 UTC · Dec 18, 2023VulnerabilityExploitedCVE-2023-50164 CVE-2017-56382

Week in review: Apache Struts vulnerability exploit attempt, EOL Sophos firewalls get hotfix

Help Net SecurityDec 17, 00:00 UTC · Dec 17, 2023VulnerabilityExploitedCVE-2022-3236 CVE-2023-50164 CVE-2021-44228+12 · 1 read