CVE Vulnerability Advisory Database

[Affected Scope] Atlassian Confluence Server and Data Center versions from 1.3.0 before 7.4.17, and specific release lines up to 7.18.1

[Impact] An unauthenticated remote attacker can execute arbitrary Java code on the Confluence instance with system privileges, leading to full host compromise.

[Mitigation] Immediately upgrade Confluence to the patched versions (7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, 7.18.1 or higher) or apply the vendor-provided workaround JAR files.

[Affected Scope] Atlassian Confluence Server and Data Center versions prior to 6.13.23, 6.14.0 to < 7.4.11, 7.5.0 to < 7.11.6, and 7.12.0 to < 7.12.5

[Impact] An unauthenticated, remote attacker can execute arbitrary OS commands with system privileges on the target instance by sending a specially crafted HTTP request.

[Mitigation] Immediately upgrade Confluence instances to the patched versions (6.13.23, 7.4.11, 7.11.6, 7.12.5, or later) or apply the vendor-provided workaround scripts.

[Affected Scope] Apache Struts framework versions 2.0.0 through 2.5.25

[Impact] Unauthenticated remote attackers can execute arbitrary code on the host system by exploiting forced double OGNL evaluation in tag attributes

[Mitigation] Immediately upgrade Apache Struts to version 2.5.26 or higher, and avoid evaluating raw user input inside Struts tag attributes

[Affected Scope] Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with system privileges via crafted HTTP requests

[Mitigation] Immediately upgrade Apache Struts to patched versions (2.3.35, 2.5.17, or higher) and review namespace configurations.

[Affected Scope] Web applications running Apache Struts 2.1.x and 2.3.x that utilize the Struts 1 integration plugin (struts2-struts1-plugin)

[Impact] Unauthenticated remote attackers can execute arbitrary system commands under the privileges of the web server, leading to complete system compromise

[Mitigation] Upgrade to the latest supported Apache Struts 2.5.x+ versions, or completely disable and remove the struts2-struts1-plugin dependency

[Affected Scope] Apache Struts versions 2.3.19 through 2.3.28 with Dynamic Method Invocation (DMI) enabled.

[Impact] Remote attackers can execute arbitrary code (RCE) with server privileges via specially crafted HTTP requests, leading to full system compromise.

[Mitigation] Immediately upgrade to Struts 2.3.20.3, 2.3.24.3, or 2.3.28.1 and set 'struts.enable.DynamicMethodInvocation' to 'false'.

[Affected Scope] Apache Struts framework versions 2.0.0 through 2.3.15

[Impact] Remote attackers can execute arbitrary OGNL expressions via crafted 'action:', 'redirect:', or 'redirectAction:' parameter prefixes, leading to full system compromise

[Mitigation] Immediately upgrade Apache Struts to version 2.3.15.1 or higher, or implement strict WAF rules to block vulnerable parameter prefixes

[Affected Scope] Apache Struts versions prior to 2.2.3.1

[Impact] Unauthenticated remote attackers can execute arbitrary Java code with system privileges on the target server by sending crafted HTTP request parameters.

[Mitigation] Immediately upgrade Apache Struts to version 2.2.3.1 or later secure releases.