Permissions, Privileges, and Access Controls in Apache Struts - CVE-2011-5057

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU90112

Permissions, Privileges, and Access Controls in Apache Struts - CVE-2011-5057

Published: May 31, 2024


Vulnerability identifier: #VU90112
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2011-5057
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to Apache Struts provides interfaces that do not properly restrict access to collections such as the session and request collections. A remote attacker can modify run-time data values via a crafted parameter to an application that implements an affected interface.


Affected software

Apache Struts
IBM Sterling Order Management
Call Center for Commerce

How to mitigate CVE-2011-5057

Install updates from vendor's website.

Apache Struts - update to 2.3.3
IBM Sterling Order Management - update to 10.0.0.29
Call Center for Commerce - update to 10.0.12

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins