Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.
References
| Link | Resource |
|---|---|
| http://issues.apache.org/struts/browse/WW-2779 | |
| http://osvdb.org/49733 | |
| http://osvdb.org/49734 | |
| http://secunia.com/advisories/32497 | Vendor Advisory |
| http://struts.apache.org/2.x/docs/s2-004.html | Vendor Advisory |
| http://www.securityfocus.com/bid/32104 | Vendor Advisory |
| http://www.vupen.com/english/advisories/2008/3003 | Vendor Advisory |
| http://issues.apache.org/struts/browse/WW-2779 | |
| http://osvdb.org/49733 | |
| http://osvdb.org/49734 | |
| http://secunia.com/advisories/32497 | Vendor Advisory |
| http://struts.apache.org/2.x/docs/s2-004.html | Vendor Advisory |
| http://www.securityfocus.com/bid/32104 | Vendor Advisory |
| http://www.vupen.com/english/advisories/2008/3003 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 00:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://issues.apache.org/struts/browse/WW-2779 - | |
| References | () http://osvdb.org/49733 - | |
| References | () http://osvdb.org/49734 - | |
| References | () http://secunia.com/advisories/32497 - Vendor Advisory | |
| References | () http://struts.apache.org/2.x/docs/s2-004.html - Vendor Advisory | |
| References | () http://www.securityfocus.com/bid/32104 - Vendor Advisory | |
| References | () http://www.vupen.com/english/advisories/2008/3003 - Vendor Advisory |
Information
Published : 2009-03-23 14:19
Updated : 2024-11-21 00:56
NVD link : CVE-2008-6505
Mitre link : CVE-2008-6505
CVE.ORG link : CVE-2008-6505
JSON object : View
Products Affected
apache
- struts
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')