CVE Vulnerability Advisory Database

[Affected Scope] Web applications running Apache Struts 2.1.x and 2.3.x that utilize the Struts 1 integration plugin (struts2-struts1-plugin)

[Impact] Unauthenticated remote attackers can execute arbitrary system commands under the privileges of the web server, leading to complete system compromise

[Mitigation] Upgrade to the latest supported Apache Struts 2.5.x+ versions, or completely disable and remove the struts2-struts1-plugin dependency

[Affected Scope] Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 Update 11 and earlier, and ColdFusion 10 Update 22 and earlier.

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending crafted Action Message Format (AMF) payloads.

[Mitigation] Apply the official Adobe security updates (APSB17-14) immediately and restrict external access to AMF gateway endpoints.

[Affected Scope] Apache Tomcat versions before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12, when JmxRemoteLifecycleListener is enabled

[Impact] Remote attackers with network access to JMX ports can trigger untrusted deserialization without authentication, leading to arbitrary Remote Code Execution (RCE) with system privileges

[Mitigation] Upgrade Apache Tomcat to the latest secure release, or disable JmxRemoteLifecycleListener in server.xml and restrict network access to JMX ports using firewalls

[Affected Scope] Web applications built on Apache Struts 2.3.x (before 2.3.32) and 2.5.x (before 2.5.10.1)

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with system privileges via crafted HTTP headers such as Content-Type

[Mitigation] Immediately upgrade Apache Struts to a secure version (2.3.32, 2.5.10.1, or higher) and apply WAF rules to block malicious OGNL payloads

[Affected Scope] All Java applications utilizing Apache Shiro versions prior to 1.2.5

[Impact] Remote attackers can leverage the hardcoded default AES encryption key to send malicious serialized objects, leading to arbitrary code execution (RCE) or access control bypass

[Mitigation] Immediately upgrade Apache Shiro to version 1.2.5 or higher, and explicitly configure a unique, secure random cipher key for the RememberMe service

[Affected Scope] Apache ActiveMQ 5.x before 5.14.0 with the Fileserver web application enabled

[Impact] Unauthenticated remote attackers can upload and execute arbitrary JSP files via HTTP PUT and MOVE requests, leading to complete system compromise

[Mitigation] Upgrade Apache ActiveMQ to version 5.14.0 or later, or disable the Fileserver web application in the jetty.xml configuration

[Affected Scope] IBM WebSphere Application Server and associated business, analytics, and mobile solutions utilizing vulnerable Apache Commons Collections library versions

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with system privileges by sending crafted serialized Java objects to exposed interfaces

[Mitigation] Apply official IBM security patches (Interim Fixes) immediately, or implement JVM-level deserialization filters to block the InvokerTransformer class

[Affected Scope] Apache Struts framework versions 2.0.0 through 2.3.15

[Impact] Remote attackers can execute arbitrary OGNL expressions via crafted 'action:', 'redirect:', or 'redirectAction:' parameter prefixes, leading to full system compromise

[Mitigation] Immediately upgrade Apache Struts to version 2.3.15.1 or higher, or implement strict WAF rules to block vulnerable parameter prefixes

[Affected Scope] Apache Struts versions prior to 2.2.3.1

[Impact] Unauthenticated remote attackers can execute arbitrary Java code with system privileges on the target server by sending crafted HTTP request parameters.

[Mitigation] Immediately upgrade Apache Struts to version 2.2.3.1 or later secure releases.