Upstream information

CVE-2017-5638 at MITRE

Description

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 mishandles file upload, which allows remote attackers to execute arbitrary commands via a #cmd= string in a crafted Content-Type HTTP header, as exploited in the wild in March 2017.

SUSE information

CVSS v2 Scores
  National Vulnerability Database
Base Score 10.00
Vector AV:N/AC:L/Au:N/C:C/I:C/A:C
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact Complete
Integrity Impact Complete
Availability Impact Complete
CVSS v3 Scores
  National Vulnerability Database
Base Score 10
Vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Access Vector Network
Access Complexity Low
Privileges Required None
User Interaction None
Scope Changed
Confidentiality Impact High
Integrity Impact High
Availability Impact High

Note from the SUSE Security Team

SUSE is not shipping struts version 2 packages, so SUSE is not affected by this problem.

SUSE Bugzilla entries: 1029412 [RESOLVED / DUPLICATE], 1029417 [RESOLVED / FIXED]

No SUSE Security Announcements cross referenced.