CVE-2017-5638
Scores
EPSS Score
0.9434
CVSS
3.x 9.8
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
All CVSS Scores
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Description
Парсер Jakarta Multipart в Apache Struts 2 2.3.x до 2.3.32 и 2.5.x до 2.5.10.1 имеет неверную обработку исключений и генерацию сообщений об ошибках во время попыток загрузки файла, что позволяет удаленным злоумышленникам выполнять произвольные команды через специально подготовленный заголовок HTTP Content-Type, Content-Disposition или Content-Length, как было эксплуатировано в дикой природе в марте 2017 года с заголовком Content-Type, содержащим строку #cmd=.
Sources
CWEs
Related Vulnerabilities
Exploits
Exploit ID: CVE-2017-5638
Source: cisa
URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Reference Links
Vulnerable Software
Type: Configuration
Product: libstruts1.2-java
Operating System: debian
{
"unaffected": true
}Source: debian
Type: Configuration
Product: libstruts1.2-java
Operating System: ubuntu trusty 14.04
{
"unaffected": true
}Source: ubuntu
Type: Configuration
Vendor: apache
Product: struts
Operating System: * * *
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.32",
"versionStartIncluding": "2.2.3",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.5.10.1",
"versionStartIncluding": "2.5.0",
"vulnerable": true
}
],
"operator": "OR"
}Source: nvd
Type: Configuration
Vendor: arubanetworks
Product: clearpass_policy_manager
Operating System: * * *
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.5",
"vulnerable": true
}
],
"operator": "OR"
}Source: nvd
Type: Configuration
Vendor: hp
Product: server_automation
Operating System: * * *
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:a:hp:server_automation:9.1.0:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:a:hp:server_automation:10.0.0:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:a:hp:server_automation:10.1.0:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:a:hp:server_automation:10.2.0:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:a:hp:server_automation:10.5.0:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"operator": "OR"
}Source: nvd
Type: Configuration
Vendor: ibm
Product: storwize_v3500_firmware
Operating System: * * *
{
"children": [
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:o:ibm:storwize_v3500_firmware:7.7.1.6:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:o:ibm:storwize_v3500_firmware:7.8.1.0:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"operator": "OR"
},
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:h:ibm:storwize_v3500:-:*:*:*:*:*:*:*"
}
],
"operator": "OR"
}
],
"operator": "AND"
}Source: nvd
Type: Configuration
Vendor: ibm
Product: storwize_v5000_firmware
Operating System: * * *
{
"children": [
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:o:ibm:storwize_v5000_firmware:7.7.1.6:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:o:ibm:storwize_v5000_firmware:7.8.1.0:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"operator": "OR"
},
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:h:ibm:storwize_v5000:-:*:*:*:*:*:*:*"
}
],
"operator": "OR"
}
],
"operator": "AND"
}Source: nvd
Type: Configuration
Vendor: ibm
Product: storwize_v7000_firmware
Operating System: * * *
{
"children": [
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:o:ibm:storwize_v7000_firmware:7.7.1.6:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:o:ibm:storwize_v7000_firmware:7.8.1.0:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"operator": "OR"
},
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:h:ibm:storwize_v7000:-:*:*:*:*:*:*:*"
}
],
"operator": "OR"
}
],
"operator": "AND"
}Source: nvd
Type: Configuration
Vendor: lenovo
Product: storage_v5030_firmware
Operating System: * * *
{
"children": [
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:o:lenovo:storage_v5030_firmware:7.7.1.6:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:o:lenovo:storage_v5030_firmware:7.8.1.0:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"operator": "OR"
},
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:h:lenovo:storage_v5030:-:*:*:*:*:*:*:*"
}
],
"operator": "OR"
}
],
"operator": "AND"
}Source: nvd
Type: Configuration
Vendor: netapp
Product: oncommand_balance
Operating System: * * *
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"operator": "OR"
}Source: nvd
Type: Configuration
Vendor: oracle
Product: weblogic_server
Operating System: * * *
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:a:oracle:weblogic_server:12.2.1.1.0:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:a:oracle:weblogic_server:12.2.1.2.0:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"operator": "OR"
}Source: nvd