CVE-2019-0233

HIGH

Apache Struts 2.0.0-2.5.20 - Denial of Service via File Upload Permission Override

Title source: llm
STIX 2.1

Description

An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.

References (5)

Core 5
Core References
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpujan2021.html
Permissions Required, Third Party Advisory x_refsource_misc
https://launchpad.support.sap.com/#/notes/2982840
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpuApr2021.html
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpuoct2021.html

Scores

CVSS v3 7.5
EPSS 0.0778
EPSS Percentile 92.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-281
Status published
Products (7)
apache/struts 2.0.0 - 2.5.20
oracle/communications_policy_management 12.5.0
oracle/financial_services_data_integration_hub 8.0.3
oracle/financial_services_data_integration_hub 8.0.6
oracle/financial_services_market_risk_measurement_and_management 8.0.6
oracle/mysql_enterprise_monitor < 8.0.23
org.apache.struts/struts2-core 2.0.0 - 2.5.22Maven
Published Sep 14, 2020
Tracked Since Feb 18, 2026