SB2018082203 - Remote code execution in Apache Struts

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018082203

SB2018082203 - Remote code execution in Apache Struts

Published: August 22, 2018

Security Bulletin ID SB2018082203
Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Improper input validation (CVE-ID: CVE-2018-11776)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient input validation in cases where namespace value isn't set for a result defined in underlying xml configurations and in same time, its upper action(s) configurations have no or wildcard namespace, or when using url tag which doesn’t have value and action set and in same time, its upper action(s) configurations have no or wildcard namespace.

A remote unauthenticated attacker can compromise the affected system.


Remediation

Install update from vendor's website.

References