#VU45702 Improper access control in Apache Struts - CVE-2019-0233
Published: August 14, 2020
Apache Struts
Apache Foundation
Description
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due stack-accessible values (e.g. Action properties) of type java.io.File and java.nio.File as well as other classes from these standard library packages are not properly protected by the framework. When a file upload is performed to
an Action that exposes the file with a getter, an attacker may
manipulate the request such that the working copy of the uploaded file
is set to read-only. As a result, subsequent actions on the file will
fail with an error. It might also be possible to set the Servlet
container's temp directory to read only, such that subsequent upload
actions will fail.