V
Scaner-VS
ENRU
HomeCatalogSourcesCWECAPECATT&CKMitigationsProductsVendorsDocs
←Back to catalog
BDU:2015-00402
BDU
HighConfirmedExploit available

Уязвимость реализации метода getClass программной платформы Apache Struts связана с недостатками разграничения доступа при использовании кл…

CVSS
7.1
High
EPSS
0.00
p0
Published
2015-01-01
Updated
2015-01-01
Description

Уязвимость реализации метода getClass программной платформы Apache Struts связана с недостатками разграничения доступа при использовании класса ParametersInterceptor с параметром class. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код путем отправки специально созданного запроса

Tags · CWE
Pre-auth
Affected products
Apache software foundation StrutsBroadcom inc. Vmware aria automation orchestratorBroadcom inc. Vmware aria operationsBroadcom inc. Vmware aria operationsIbm corp. Ibm sterling field salesIbm corp. Ibm sterling field salesIbm corp. Ibm sterling field salesIbm corp. Ibm sterling field salesIbm corp. Ibm sterling field salesIbm corp. Ibm sterling order managementIbm corp. Ibm sterling selling and fulfillment foundationIbm corp. Ibm sterling selling and fulfillment foundationIbm corp. Ibm sterling selling and fulfillment foundationIbm corp. Ibm sterling selling and fulfillment foundationIbm corp. Ibm sterling selling and fulfillment foundationIbm corp. Ibm sterling web channelIbm corp. Ibm sterling web channelOracle corp. Mysql enterprise monitorOracle corp. Mysql enterprise monitorOracle corp. Webcenter sites
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Timeline
2015-01-01
Published
2015-01-01
Updated
CVSS 3.1 breakdown
Attack Vector
AV: N
Network (N)
Attack Complexity
AC: L
Low (L)
Privileges Required
PR: N
None (N)
User Interaction
UI: R
Required (R)
Scope
S: C
Changed (C)
Confidentiality Impact
C: L
Low (L)
Integrity Impact
I: L
Low (L)
Availability Impact
A: L
Low (L)
Exploit indicators
EPSS
0.000 · p0
Known exploited (KEV)
No
Known exploits — Сканер-ВС
33142
exploitdb · https://www.exploit-db.com/exploits/33142
Enterprise
41690
exploitdb · https://www.exploit-db.com/exploits/41690
Enterprise
Affected products
Red Hat
Red Hat Jboss Fuse
Oracle
Mysql Enterprise MonitorWebcenter Sites
IBM
Ibm Sterling Order ManagementIbm Sterling Field SalesIbm Sterling Selling And Fulfillment FoundationIbm Sterling Web Channel
Apache
Struts
Broadcom
Vmware Aria OperationsVmware Aria Automation Orchestrator
ProductVendorStatus
strutsapache software foundationTracked
vmware aria automation orchestratorbroadcom inc.Tracked
vmware aria operationsbroadcom inc.Tracked
vmware aria operationsbroadcom inc.Tracked
ibm sterling field salesibm corp.Tracked
ibm sterling field salesibm corp.Tracked
ibm sterling field salesibm corp.Tracked
ibm sterling field salesibm corp.Tracked
ibm sterling field salesibm corp.Tracked
ibm sterling order managementibm corp.Tracked
ibm sterling selling and fulfillment foundationibm corp.Tracked
ibm sterling selling and fulfillment foundationibm corp.Tracked
ibm sterling selling and fulfillment foundationibm corp.Tracked
ibm sterling selling and fulfillment foundationibm corp.Tracked
ibm sterling selling and fulfillment foundationibm corp.Tracked
ibm sterling web channelibm corp.Tracked
ibm sterling web channelibm corp.Tracked
mysql enterprise monitororacle corp.Tracked
mysql enterprise monitororacle corp.Tracked
webcenter sitesoracle corp.Tracked
Showing first 20 of 22
Source databases
BDU
Related vulnerabilities
CVE-2014-0112