APACHE FIXED CRITICAL RCE FLAW CVE-2023-50164 at STRUTS 2

The Apache Software Foundation fixed a critical file upload vulnerability in the Struts 2 open-source framework. This flaw, tracked as CVE-2023-50164, could allow remote code execution.

An attacker can manipulate file upload parameters to upload a malicious file and execute code on the server.

• Uncategorized

Cisco released security updates for two critical security flaws

By infosecbulletin / Thursday , September 5 2024

CISCO released security updates for two critical security flaws impacting its smart Licensing Utility that could allow unauthenticated, remote attackers...

Read More

• Hot Topic

OpenBAS: Cutting-edge breach and attack simulation platform

By infosecbulletin / Wednesday , September 4 2024

OpenBAS is a platform that helps organizations to plan, schedule, and conduct crisis exercises, adversary simulations, and breach simulations. OpenBAS...

Read More

• Vulnerabilities

Critical Security Flaws Patched in Zyxel Networking Devices

By infosecbulletin / Wednesday , September 4 2024

Zyxel has released software updates to fix a serious security issue in certain access point (AP) and security router versions....

Read More

• Vulnerabilities

CVE-2024-38811: CEV In VMware Fusion Unveiled

By infosecbulletin / Tuesday , September 3 2024

VMware released a security advisory for a major vulnerability in the VMware Fusion product. This vulnerability could be exploited by...

Read More

• Cyber Attack
• Vulnerabilities

CERT-IN Warns Vulnerabilities in Palo Alto Networks applications

By infosecbulletin / Tuesday , September 3 2024

Indian Computer Emergency Response Team (CERT-IN) issued advisories about multiple vulnerabilities in various Palo Alto Networks applications. Attackers could exploit...

Read More

• International

How Malaysia’s Data Centre Industry Poised for Growth

By infosecbulletin / Tuesday , September 3 2024

Malaysia is quickly becoming a leading choice for investing in data centers. It aims to generate RM3.6 billion (US$781 million)...

Read More

• Cyber Attack

RansomHub exfiltrated data over 210 victims: US alert

By infosecbulletin / Tuesday , September 3 2024

US authorities have issued a cybersecurity advisory about a ransomware group called RansomHub. The group is thought to have stolen data...

Read More

• Vulnerabilities

Godzilla Fileless Backdoor Exploits Atlassian Confluence flaw

By infosecbulletin / Tuesday , September 3 2024

There is a new way to attack Atlassian Confluence using the vulnerability CVE-2023-22527. The Confluence Data Center and Server products...

Read More

• Cyber Attack

New Cicada ransomware targets VMware ESXi servers

By infosecbulletin / Tuesday , September 3 2024

The Cicada3301 ransomware is made in Rust and attacks Windows and Linux/ESXi hosts. Truesec researchers examined a version that targets...

Read More

• Uncategorized

Monday hits two UK bank apps causes outages

By infosecbulletin / Tuesday , September 3 2024

Lloyds Bank and Virgin Money's internet banking services were down on Monday, causing trouble for users to access and view...

Read More

“An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.” reads the advisory published by Apache Software Foundation. Upgrade to Struts 2.5.33 or higher, as advised by the foundation.

Steven Seeley from Source Incite reported the vulnerability. Apache has not confirmed any active exploitation in attacks.

ALSO READ:

Mid-sized Canadian firms pay an average $1.13 million to ransomware gangs