CVE-2024-53677
CRITICAL 18 PoCs
ACT NOW
Priority: 6.87
BB Relevance:
89/100
Published: 2024-12-11
Modified: 2026-11-04
First seen: 2026-11-03
Status: active
Attack Surface
Network
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
None
UI:
None
S:
N
AT:
Present
VC:
High
VI:
High
VA:
High
Description
File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe. You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067
Weakness Classification (1)
Affected Software (3)
| Vendor | Product | Version |
|---|---|---|
| Apache Software Foundation | Apache Struts | 2.0.0 < 6.4.0 |
| Apache Software Foundation | Apache Struts | 2.0.0 < 6.4.0 |
| apache | struts | 2.0.0 – 6.4.0 |
References & Advisories (2)
vendor-advisory
Third Party Advisory