CVE-2023-50164 is a critical vulnerability discovered in Apache Struts2, an extensively used open-source Model-View-Controller (MVC) framework for Java web applications.
Here’s a detailed breakdown based on the latest information.
Vulnerability Details
CVE-2023-50164 allows an attacker to manipulate file upload parameters, enabling path traversal. Under certain conditions, this can lead to the uploading of a malicious file, which can be leveraged to perform Remote Code Execution (RCE). Impact: This vulnerability poses a serious threat as it could potentially enable remote attackers to execute arbitrary code on affected servers.Technical Specifications
- Flawed Component: The vulnerability stems from a defective file upload logic in Apache Struts 2.
- Severity Rating: It has a CVSS 3.x base score of 9.8, categorized as CRITICAL. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating that the vulnerability is both highly damaging and easy to exploit.