CVE Vulnerability Advisory Database

[Affected Scope] Apache HTTP Server versions 2.4.48 and earlier with mod_proxy enabled

[Impact] Unauthenticated remote attackers can craft malicious URI paths to force mod_proxy to forward requests to an arbitrary origin server, leading to SSRF

[Mitigation] Immediately upgrade Apache HTTP Server to version 2.4.49 or later, or apply strict RewriteRules to block malicious proxy requests

[Affected Scope] Apache Flink versions 1.11.0, 1.11.1, and 1.11.2

[Impact] Unauthenticated remote attackers can read arbitrary files on the JobManager local filesystem via the REST interface

[Mitigation] Immediately upgrade to Apache Flink 1.11.3, 1.12.0, or later versions

[Affected Scope] Apache Struts framework versions 2.0.0 through 2.5.25

[Impact] Unauthenticated remote attackers can execute arbitrary code on the host system by exploiting forced double OGNL evaluation in tag attributes

[Mitigation] Immediately upgrade Apache Struts to version 2.5.26 or higher, and avoid evaluating raw user input inside Struts tag attributes

[Affected Scope] Apache Airflow versions prior to 1.10.11, and existing installations retaining default configurations

[Impact] Unauthenticated attackers can access the Experimental API to trigger arbitrary DAGs, leading to full remote code execution (RCE) and server compromise

[Mitigation] Upgrade Apache Airflow to version 1.10.11 or higher, or explicitly configure the API authentication backend to 'deny_all' in airflow.cfg

[Affected Scope] Apache Airflow versions 1.10.10 and below with example DAGs enabled (load_examples=True)

[Impact] Authenticated attackers can execute arbitrary OS commands with the privileges of the Airflow worker/scheduler by injecting malicious payloads into example DAG parameters

[Mitigation] Upgrade Apache Airflow to version 1.10.11 or higher, or disable example DAGs by setting load_examples=False in airflow.cfg

[Affected Scope] Apache Kylin versions 2.3.0 through 2.6.5, and version 3.0.1

[Impact] Authenticated attackers can exploit the lack of input validation to execute arbitrary OS commands and gain full control over the hosting server

[Mitigation] Immediately upgrade to Apache Kylin 2.6.6, 3.0.2, or later, or apply configuration workarounds to disable vulnerable features

[Affected Scope] Apache Tomcat versions 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50, and 7.0.0 to 7.0.99

[Impact] Attackers with access to the AJP port (default 8009) can read arbitrary files from the web application or execute arbitrary code (RCE) if file upload is permitted

[Mitigation] Upgrade to Apache Tomcat 9.0.31, 8.5.51, 7.0.100 or later, or disable/restrict the AJP Connector in the configuration

[Affected Scope] Apache Solr versions 5.0.0 through 8.3.1

[Impact] Remote attackers can modify Solr configurations via the Config API to enable the Velocity template loader and execute arbitrary system commands on the host

[Mitigation] Upgrade to Apache Solr 8.4.0 or later, or disable the 'params.resource.loader.enabled' setting and restrict access to the Config API

[Affected Scope] Apache Solr versions prior to 8.2.0 with the DataImportHandler (DIH) module enabled

[Impact] An authenticated attacker (or an attacker with admin access) can execute arbitrary system commands on the host server by sending a malicious DIH configuration

[Mitigation] Upgrade Apache Solr to version 8.2.0 or higher, or explicitly disable the 'enable.dih.dataConfigParam' Java system property

[Affected Scope] Apache HTTP Server versions 2.4.17 to 2.4.38 running on Unix-like operating systems with event, worker, or prefork MPMs enabled

[Impact] A low-privileged child process or in-process scripting engine (e.g., PHP, CGI) can manipulate the shared scoreboard memory to execute arbitrary code with root privileges of the parent process

[Mitigation] Immediately upgrade Apache HTTP Server to the latest stable version (2.4.39 or higher) and restrict script execution privileges

[Affected Scope] Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with system privileges via crafted HTTP requests

[Mitigation] Immediately upgrade Apache Struts to patched versions (2.3.35, 2.5.17, or higher) and review namespace configurations.

[Affected Scope] Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46, and 7.0.0 to 7.0.81 when the 'readonly' parameter of the DefaultServlet is set to false

[Impact] Unauthenticated remote attackers can upload malicious JSP files using crafted HTTP PUT requests, leading to arbitrary code execution with the privileges of the Tomcat process

[Mitigation] Upgrade Apache Tomcat to the latest secure versions, or modify the web.xml configuration to ensure the 'readonly' parameter is set to true (default)

[Affected Scope] Apache Tomcat versions 7.0.0 to 7.0.79 running on Windows with the 'readonly' initialization parameter set to 'false'.

[Impact] Unauthenticated remote attackers can upload malicious JSP files via specially crafted HTTP PUT requests, leading to arbitrary code execution under the context of the Tomcat process.

[Mitigation] Immediately upgrade Apache Tomcat to version 7.0.81 or later, or revert the 'readonly' parameter to 'true' in the web.xml configuration.

[Affected Scope] Apache Struts versions 2.1.1 through 2.3.33 and 2.5 through 2.5.12 using the REST plugin

[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the target server by sending malicious XML payloads

[Mitigation] Immediately upgrade Apache Struts to version 2.3.34 or 2.5.13 or higher, or restrict/disable XML handling in the REST plugin

[Affected Scope] Web applications running Apache Struts 2.1.x and 2.3.x that utilize the Struts 1 integration plugin (struts2-struts1-plugin)

[Impact] Unauthenticated remote attackers can execute arbitrary system commands under the privileges of the web server, leading to complete system compromise

[Mitigation] Upgrade to the latest supported Apache Struts 2.5.x+ versions, or completely disable and remove the struts2-struts1-plugin dependency

[Affected Scope] Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 Update 11 and earlier, and ColdFusion 10 Update 22 and earlier.

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending crafted Action Message Format (AMF) payloads.

[Mitigation] Apply the official Adobe security updates (APSB17-14) immediately and restrict external access to AMF gateway endpoints.

[Affected Scope] Apache Tomcat versions before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12, when JmxRemoteLifecycleListener is enabled

[Impact] Remote attackers with network access to JMX ports can trigger untrusted deserialization without authentication, leading to arbitrary Remote Code Execution (RCE) with system privileges

[Mitigation] Upgrade Apache Tomcat to the latest secure release, or disable JmxRemoteLifecycleListener in server.xml and restrict network access to JMX ports using firewalls

[Affected Scope] Web applications built on Apache Struts 2.3.x (before 2.3.32) and 2.5.x (before 2.5.10.1)

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with system privileges via crafted HTTP headers such as Content-Type

[Mitigation] Immediately upgrade Apache Struts to a secure version (2.3.32, 2.5.10.1, or higher) and apply WAF rules to block malicious OGNL payloads

[Affected Scope] All Java applications utilizing Apache Shiro versions prior to 1.2.5

[Impact] Remote attackers can leverage the hardcoded default AES encryption key to send malicious serialized objects, leading to arbitrary code execution (RCE) or access control bypass

[Mitigation] Immediately upgrade Apache Shiro to version 1.2.5 or higher, and explicitly configure a unique, secure random cipher key for the RememberMe service

[Affected Scope] Apache ActiveMQ 5.x before 5.14.0 with the Fileserver web application enabled

[Impact] Unauthenticated remote attackers can upload and execute arbitrary JSP files via HTTP PUT and MOVE requests, leading to complete system compromise

[Mitigation] Upgrade Apache ActiveMQ to version 5.14.0 or later, or disable the Fileserver web application in the jetty.xml configuration