{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53677.json" } ], "title": "struts: org.apache.struts: mixing setters for uploaded files and normal fields can allow bypass file upload checks", "tracking": { "current_release_date": "2026-08-04T17:36:35+00:00", "generator": { "date": "2026-08-04T17:36:35+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.3.8" } }, "id": "CVE-2024-53677", "initial_release_date": "2024-12-11T15:35:43.389000+00:00", "revision_history": [ { "date": "2024-12-11T15:35:43.389000+00:00", "number": "1", "summary": "Initial version" }, { "date": "2026-08-04T17:12:18+00:00", "number": "2", "summary": "Current version" }, { "date": "2026-08-04T17:36:35+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "A-MQ Clients 2", "product": { "name": "A-MQ Clients 2", "product_id": "a-mq_clients_2", "product_identification_helper": { "cpe": "cpe:/a:redhat:a_mq_clients:2" } } } ], "category": "product_family", "name": "A-MQ Clients 2" }, { "branches": [ { "category": "product_name", "name": "Red Hat AMQ Broker 7", "product": { "name": "Red Hat AMQ Broker 7", "product_id": "red_hat_amq_broker_7", "product_identification_helper": { "cpe": "cpe:/a:redhat:amq_broker:7" } } } ], "category": "product_family", "name": "Red Hat AMQ Broker 7" }, { "branches": [ { "category": "product_name", "name": "Red Hat build of Apache Camel for Spring Boot 4", "product": { "name": "Red Hat build of Apache Camel for Spring Boot 4", "product_id": "red_hat_build_of_apache_camel_for_spring_boot_4", "product_identification_helper": { "cpe": "cpe:/a:redhat:camel_spring_boot:4" } } } ], "category": "product_family", "name": "Red Hat build of Apache Camel for Spring Boot 4" }, { "branches": [ { "category": "product_name", "name": "Red Hat build of Debezium 2", "product": { "name": "Red Hat build of Debezium 2", "product_id": "red_hat_build_of_debezium_2", "product_identification_helper": { "cpe": "cpe:/a:redhat:debezium:2" } } } ], "category": "product_family", "name": "Red Hat build of Debezium 2" }, { "branches": [ { "category": "product_name", "name": "Red Hat Build of Keycloak", "product": { "name": "Red Hat Build of Keycloak", "product_id": "red_hat_build_of_keycloak", "product_identification_helper": { "cpe": "cpe:/a:redhat:build_keycloak:" } } } ], "category": "product_family", "name": "Red Hat Build of Keycloak" }, { "branches": [ { "category": "product_name", "name": "Red Hat build of OptaPlanner 8", "product": { "name": "Red Hat build of OptaPlanner 8", "product_id": "red_hat_build_of_optaplanner_8", "product_identification_helper": { "cpe": "cpe:/a:redhat:optaplanner:::el6" } } } ], "category": "product_family", "name": "Red Hat build of OptaPlanner 8" }, { "branches": [ { "category": "product_name", "name": "Red Hat Data Grid 8", "product": { "name": "Red Hat Data Grid 8", "product_id": "red_hat_data_grid_8", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_data_grid:8" } } } ], "category": "product_family", "name": "Red Hat Data Grid 8" }, { "branches": [ { "category": "product_name", "name": "Red Hat Fuse 7", "product": { "name": "Red Hat Fuse 7", "product_id": "red_hat_fuse_7", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_fuse:7" } } } ], "category": "product_family", "name": "Red Hat Fuse 7" }, { "branches": [ { "category": "product_name", "name": "Red Hat Integration Camel K 1", "product": { "name": "Red Hat Integration Camel K 1", "product_id": "red_hat_integration_camel_k_1", "product_identification_helper": { "cpe": "cpe:/a:redhat:integration:1" } } } ], "category": "product_family", "name": "Red Hat Integration Camel K 1" }, { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Data Grid 7", "product": { "name": "Red Hat JBoss Data Grid 7", "product_id": "red_hat_jboss_data_grid_7", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_data_grid:7" } } } ], "category": "product_family", "name": "Red Hat JBoss Data Grid 7" }, { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Enterprise Application Platform 7", "product": { "name": "Red Hat JBoss Enterprise Application Platform 7", "product_id": "red_hat_jboss_enterprise_application_platform_7", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7" } } } ], "category": "product_family", "name": "Red Hat JBoss Enterprise Application Platform 7" }, { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Enterprise Application Platform 8", "product": { "name": "Red Hat JBoss Enterprise Application Platform 8", "product_id": "red_hat_jboss_enterprise_application_platform_8", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8" } } } ], "category": "product_family", "name": "Red Hat JBoss Enterprise Application Platform 8" }, { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "product": { "name": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "product_id": "red_hat_jboss_enterprise_application_platform_expansion_pack", "product_identification_helper": { "cpe": "cpe:/a:redhat:jbosseapxp" } } } ], "category": "product_family", "name": "Red Hat JBoss Enterprise Application Platform Expansion Pack" }, { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Fuse Service Works 6", "product": { "name": "Red Hat JBoss Fuse Service Works 6", "product_id": "red_hat_jboss_fuse_service_works_6", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_fuse_service_works:6" } } } ], "category": "product_family", "name": "Red Hat JBoss Fuse Service Works 6" }, { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Web Server 5", "product": { "name": "Red Hat JBoss Web Server 5", "product_id": "red_hat_jboss_web_server_5", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5" } } } ], "category": "product_family", "name": "Red Hat JBoss Web Server 5" }, { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Web Server 6", "product": { "name": "Red Hat JBoss Web Server 6", "product_id": "red_hat_jboss_web_server_6", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6" } } } ], "category": "product_family", "name": "Red Hat JBoss Web Server 6" }, { "branches": [ { "category": "product_name", "name": "Red Hat Process Automation 7", "product": { "name": "Red Hat Process Automation 7", "product_id": "red_hat_process_automation_7", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7" } } } ], "category": "product_family", "name": "Red Hat Process Automation 7" }, { "branches": [ { "category": "product_name", "name": "Red Hat Single Sign-On 7", "product": { "name": "Red Hat Single Sign-On 7", "product_id": "red_hat_single_sign-on_7", "product_identification_helper": { "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7" } } } ], "category": "product_family", "name": "Red Hat Single Sign-On 7" }, { "branches": [ { "category": "product_name", "name": "streams for Apache Kafka", "product": { "name": "streams for Apache Kafka", "product_id": "streams_for_apache_kafka", "product_identification_helper": { "cpe": "cpe:/a:redhat:amq_streams:1" } } } ], "category": "product_family", "name": "streams for Apache Kafka" }, { "category": "product_version", "name": "org.apache.struts/struts-taglib", "product": { "name": "org.apache.struts/struts-taglib", "product_id": "org.apache.struts/struts-taglib" } }, { "category": "product_version", "name": "org.apache.struts/struts-tiles", "product": { "name": "org.apache.struts/struts-tiles", "product_id": "org.apache.struts/struts-tiles" } }, { "category": "product_version", "name": "struts-core", "product": { "name": "struts-core", "product_id": "struts-core", "product_identification_helper": { "purl": "pkg:maven/org.apache.struts/struts-core" } } }, { "category": "product_version", "name": "com.google.inject.extensions/guice-struts2", "product": { "name": "com.google.inject.extensions/guice-struts2", "product_id": "com.google.inject.extensions/guice-struts2" } }, { "category": "product_version", "name": "org.apache.struts/struts2-core", "product": { "name": "org.apache.struts/struts2-core", "product_id": "org.apache.struts/struts2-core" } }, { "category": "product_version", "name": "org.apache.struts.xwork/xwork-core", "product": { "name": "org.apache.struts.xwork/xwork-core", "product_id": "org.apache.struts.xwork/xwork-core" } }, { "category": "product_version", "name": "opentelemetry-javaagent-struts-2.3", "product": { "name": "opentelemetry-javaagent-struts-2.3", "product_id": "opentelemetry-javaagent-struts-2.3", "product_identification_helper": { "purl": "pkg:maven/io.opentelemetry.javaagent.instrumentation/opentelemetry-javaagent-struts-2.3" } } }, { "category": "product_version", "name": "struts2-core", "product": { "name": "struts2-core", "product_id": "struts2-core", "product_identification_helper": { "purl": "pkg:maven/org.apache.struts/struts2-core" } } }, { "category": "product_version", "name": "struts-taglib", "product": { "name": "struts-taglib", "product_id": "struts-taglib", "product_identification_helper": { "purl": "pkg:maven/org.apache.struts/struts-taglib" } } }, { "category": "product_version", "name": "struts-tiles", "product": { "name": "struts-tiles", "product_id": "struts-tiles", "product_identification_helper": { "purl": "pkg:maven/org.apache.struts/struts-tiles" } } }, { "category": "product_version", "name": "xwork-core", "product": { "name": "xwork-core", "product_id": "xwork-core", "product_identification_helper": { "purl": "pkg:maven/org.apache.struts.xwork/xwork-core" } } }, { "category": "product_version", "name": "io.opentelemetry.javaagent.instrumentation/opentelemetry-javaagent-struts-2.3", "product": { "name": "io.opentelemetry.javaagent.instrumentation/opentelemetry-javaagent-struts-2.3", "product_id": "io.opentelemetry.javaagent.instrumentation/opentelemetry-javaagent-struts-2.3" } } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-taglib as a component of A-MQ Clients 2", "product_id": "a-mq_clients_2:org.apache.struts/struts-taglib" }, "product_reference": "org.apache.struts/struts-taglib", "relates_to_product_reference": "a-mq_clients_2" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-tiles as a component of A-MQ Clients 2", "product_id": "a-mq_clients_2:org.apache.struts/struts-tiles" }, "product_reference": "org.apache.struts/struts-tiles", "relates_to_product_reference": "a-mq_clients_2" }, { "category": "default_component_of", "full_product_name": { "name": "struts-core as a component of A-MQ Clients 2", "product_id": "a-mq_clients_2:struts-core" }, "product_reference": "struts-core", "relates_to_product_reference": "a-mq_clients_2" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-taglib as a component of Red Hat AMQ Broker 7", "product_id": "red_hat_amq_broker_7:org.apache.struts/struts-taglib" }, "product_reference": "org.apache.struts/struts-taglib", "relates_to_product_reference": "red_hat_amq_broker_7" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-tiles as a component of Red Hat AMQ Broker 7", "product_id": "red_hat_amq_broker_7:org.apache.struts/struts-tiles" }, "product_reference": "org.apache.struts/struts-tiles", "relates_to_product_reference": "red_hat_amq_broker_7" }, { "category": "default_component_of", "full_product_name": { "name": "struts-core as a component of Red Hat AMQ Broker 7", "product_id": "red_hat_amq_broker_7:struts-core" }, "product_reference": "struts-core", "relates_to_product_reference": "red_hat_amq_broker_7" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-taglib as a component of Red Hat build of Apache Camel for Spring Boot 4", "product_id": "red_hat_build_of_apache_camel_for_spring_boot_4:org.apache.struts/struts-taglib" }, "product_reference": "org.apache.struts/struts-taglib", "relates_to_product_reference": "red_hat_build_of_apache_camel_for_spring_boot_4" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-tiles as a component of Red Hat build of Apache Camel for Spring Boot 4", "product_id": "red_hat_build_of_apache_camel_for_spring_boot_4:org.apache.struts/struts-tiles" }, "product_reference": "org.apache.struts/struts-tiles", "relates_to_product_reference": "red_hat_build_of_apache_camel_for_spring_boot_4" }, { "category": "default_component_of", "full_product_name": { "name": "struts-core as a component of Red Hat build of Apache Camel for Spring Boot 4", "product_id": "red_hat_build_of_apache_camel_for_spring_boot_4:struts-core" }, "product_reference": "struts-core", "relates_to_product_reference": "red_hat_build_of_apache_camel_for_spring_boot_4" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-taglib as a component of Red Hat build of Debezium 2", "product_id": "red_hat_build_of_debezium_2:org.apache.struts/struts-taglib" }, "product_reference": "org.apache.struts/struts-taglib", "relates_to_product_reference": "red_hat_build_of_debezium_2" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-tiles as a component of Red Hat build of Debezium 2", "product_id": "red_hat_build_of_debezium_2:org.apache.struts/struts-tiles" }, "product_reference": "org.apache.struts/struts-tiles", "relates_to_product_reference": "red_hat_build_of_debezium_2" }, { "category": "default_component_of", "full_product_name": { "name": "struts-core as a component of Red Hat build of Debezium 2", "product_id": "red_hat_build_of_debezium_2:struts-core" }, "product_reference": "struts-core", "relates_to_product_reference": "red_hat_build_of_debezium_2" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-taglib as a component of Red Hat Build of Keycloak", "product_id": "red_hat_build_of_keycloak:org.apache.struts/struts-taglib" }, "product_reference": "org.apache.struts/struts-taglib", "relates_to_product_reference": "red_hat_build_of_keycloak" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-tiles as a component of Red Hat Build of Keycloak", "product_id": "red_hat_build_of_keycloak:org.apache.struts/struts-tiles" }, "product_reference": "org.apache.struts/struts-tiles", "relates_to_product_reference": "red_hat_build_of_keycloak" }, { "category": "default_component_of", "full_product_name": { "name": "struts-core as a component of Red Hat Build of Keycloak", "product_id": "red_hat_build_of_keycloak:struts-core" }, "product_reference": "struts-core", "relates_to_product_reference": "red_hat_build_of_keycloak" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-taglib as a component of Red Hat build of OptaPlanner 8", "product_id": "red_hat_build_of_optaplanner_8:org.apache.struts/struts-taglib" }, "product_reference": "org.apache.struts/struts-taglib", "relates_to_product_reference": "red_hat_build_of_optaplanner_8" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-tiles as a component of Red Hat build of OptaPlanner 8", "product_id": "red_hat_build_of_optaplanner_8:org.apache.struts/struts-tiles" }, "product_reference": "org.apache.struts/struts-tiles", "relates_to_product_reference": "red_hat_build_of_optaplanner_8" }, { "category": "default_component_of", "full_product_name": { "name": "struts-core as a component of Red Hat build of OptaPlanner 8", "product_id": "red_hat_build_of_optaplanner_8:struts-core" }, "product_reference": "struts-core", "relates_to_product_reference": "red_hat_build_of_optaplanner_8" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-taglib as a component of Red Hat Data Grid 8", "product_id": "red_hat_data_grid_8:org.apache.struts/struts-taglib" }, "product_reference": "org.apache.struts/struts-taglib", "relates_to_product_reference": "red_hat_data_grid_8" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-tiles as a component of Red Hat Data Grid 8", "product_id": "red_hat_data_grid_8:org.apache.struts/struts-tiles" }, "product_reference": "org.apache.struts/struts-tiles", "relates_to_product_reference": "red_hat_data_grid_8" }, { "category": "default_component_of", "full_product_name": { "name": "struts-core as a component of Red Hat Data Grid 8", "product_id": "red_hat_data_grid_8:struts-core" }, "product_reference": "struts-core", "relates_to_product_reference": "red_hat_data_grid_8" }, { "category": "default_component_of", "full_product_name": { "name": "com.google.inject.extensions/guice-struts2 as a component of Red Hat Fuse 7", "product_id": "red_hat_fuse_7:com.google.inject.extensions/guice-struts2" }, "product_reference": "com.google.inject.extensions/guice-struts2", "relates_to_product_reference": "red_hat_fuse_7" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts.xwork/xwork-core as a component of Red Hat Fuse 7", "product_id": "red_hat_fuse_7:org.apache.struts.xwork/xwork-core" }, "product_reference": "org.apache.struts.xwork/xwork-core", "relates_to_product_reference": "red_hat_fuse_7" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-taglib as a component of Red Hat Fuse 7", "product_id": "red_hat_fuse_7:org.apache.struts/struts-taglib" }, "product_reference": "org.apache.struts/struts-taglib", "relates_to_product_reference": "red_hat_fuse_7" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-tiles as a component of Red Hat Fuse 7", "product_id": "red_hat_fuse_7:org.apache.struts/struts-tiles" }, "product_reference": "org.apache.struts/struts-tiles", "relates_to_product_reference": "red_hat_fuse_7" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts2-core as a component of Red Hat Fuse 7", "product_id": "red_hat_fuse_7:org.apache.struts/struts2-core" }, "product_reference": "org.apache.struts/struts2-core", "relates_to_product_reference": "red_hat_fuse_7" }, { "category": "default_component_of", "full_product_name": { "name": "struts-core as a component of Red Hat Fuse 7", "product_id": "red_hat_fuse_7:struts-core" }, "product_reference": "struts-core", "relates_to_product_reference": "red_hat_fuse_7" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-taglib as a component of Red Hat Integration Camel K 1", "product_id": "red_hat_integration_camel_k_1:org.apache.struts/struts-taglib" }, "product_reference": "org.apache.struts/struts-taglib", "relates_to_product_reference": "red_hat_integration_camel_k_1" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-tiles as a component of Red Hat Integration Camel K 1", "product_id": "red_hat_integration_camel_k_1:org.apache.struts/struts-tiles" }, "product_reference": "org.apache.struts/struts-tiles", "relates_to_product_reference": "red_hat_integration_camel_k_1" }, { "category": "default_component_of", "full_product_name": { "name": "struts-core as a component of Red Hat Integration Camel K 1", "product_id": "red_hat_integration_camel_k_1:struts-core" }, "product_reference": "struts-core", "relates_to_product_reference": "red_hat_integration_camel_k_1" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-taglib as a component of Red Hat JBoss Data Grid 7", "product_id": "red_hat_jboss_data_grid_7:org.apache.struts/struts-taglib" }, "product_reference": "org.apache.struts/struts-taglib", "relates_to_product_reference": "red_hat_jboss_data_grid_7" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-tiles as a component of Red Hat JBoss Data Grid 7", "product_id": "red_hat_jboss_data_grid_7:org.apache.struts/struts-tiles" }, "product_reference": "org.apache.struts/struts-tiles", "relates_to_product_reference": "red_hat_jboss_data_grid_7" }, { "category": "default_component_of", "full_product_name": { "name": "struts-core as a component of Red Hat JBoss Data Grid 7", "product_id": "red_hat_jboss_data_grid_7:struts-core" }, "product_reference": "struts-core", "relates_to_product_reference": "red_hat_jboss_data_grid_7" }, { "category": "default_component_of", "full_product_name": { "name": "struts-core as a component of Red Hat JBoss Enterprise Application Platform 7", "product_id": "red_hat_jboss_enterprise_application_platform_7:struts-core" }, "product_reference": "struts-core", "relates_to_product_reference": "red_hat_jboss_enterprise_application_platform_7" }, { "category": "default_component_of", "full_product_name": { "name": "opentelemetry-javaagent-struts-2.3 as a component of Red Hat JBoss Enterprise Application Platform 8", "product_id": "red_hat_jboss_enterprise_application_platform_8:opentelemetry-javaagent-struts-2.3" }, "product_reference": "opentelemetry-javaagent-struts-2.3", "relates_to_product_reference": "red_hat_jboss_enterprise_application_platform_8" }, { "category": "default_component_of", "full_product_name": { "name": "struts-core as a component of Red Hat JBoss Enterprise Application Platform 8", "product_id": "red_hat_jboss_enterprise_application_platform_8:struts-core" }, "product_reference": "struts-core", "relates_to_product_reference": "red_hat_jboss_enterprise_application_platform_8" }, { "category": "default_component_of", "full_product_name": { "name": "struts-taglib as a component of Red Hat JBoss Enterprise Application Platform 8", "product_id": "red_hat_jboss_enterprise_application_platform_8:struts-taglib" }, "product_reference": "struts-taglib", "relates_to_product_reference": "red_hat_jboss_enterprise_application_platform_8" }, { "category": "default_component_of", "full_product_name": { "name": "struts-tiles as a component of Red Hat JBoss Enterprise Application Platform 8", "product_id": "red_hat_jboss_enterprise_application_platform_8:struts-tiles" }, "product_reference": "struts-tiles", "relates_to_product_reference": "red_hat_jboss_enterprise_application_platform_8" }, { "category": "default_component_of", "full_product_name": { "name": "struts2-core as a component of Red Hat JBoss Enterprise Application Platform 8", "product_id": "red_hat_jboss_enterprise_application_platform_8:struts2-core" }, "product_reference": "struts2-core", "relates_to_product_reference": "red_hat_jboss_enterprise_application_platform_8" }, { "category": "default_component_of", "full_product_name": { "name": "xwork-core as a component of Red Hat JBoss Enterprise Application Platform 8", "product_id": "red_hat_jboss_enterprise_application_platform_8:xwork-core" }, "product_reference": "xwork-core", "relates_to_product_reference": "red_hat_jboss_enterprise_application_platform_8" }, { "category": "default_component_of", "full_product_name": { "name": "io.opentelemetry.javaagent.instrumentation/opentelemetry-javaagent-struts-2.3 as a component of Red Hat JBoss Enterprise Application Platform Expansion Pack", "product_id": "red_hat_jboss_enterprise_application_platform_expansion_pack:io.opentelemetry.javaagent.instrumentation/opentelemetry-javaagent-struts-2.3" }, "product_reference": "io.opentelemetry.javaagent.instrumentation/opentelemetry-javaagent-struts-2.3", "relates_to_product_reference": "red_hat_jboss_enterprise_application_platform_expansion_pack" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts.xwork/xwork-core as a component of Red Hat JBoss Enterprise Application Platform Expansion Pack", "product_id": "red_hat_jboss_enterprise_application_platform_expansion_pack:org.apache.struts.xwork/xwork-core" }, "product_reference": "org.apache.struts.xwork/xwork-core", "relates_to_product_reference": "red_hat_jboss_enterprise_application_platform_expansion_pack" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-taglib as a component of Red Hat JBoss Enterprise Application Platform Expansion Pack", "product_id": "red_hat_jboss_enterprise_application_platform_expansion_pack:org.apache.struts/struts-taglib" }, "product_reference": "org.apache.struts/struts-taglib", "relates_to_product_reference": "red_hat_jboss_enterprise_application_platform_expansion_pack" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-tiles as a component of Red Hat JBoss Enterprise Application Platform Expansion Pack", "product_id": "red_hat_jboss_enterprise_application_platform_expansion_pack:org.apache.struts/struts-tiles" }, "product_reference": "org.apache.struts/struts-tiles", "relates_to_product_reference": "red_hat_jboss_enterprise_application_platform_expansion_pack" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts2-core as a component of Red Hat JBoss Enterprise Application Platform Expansion Pack", "product_id": "red_hat_jboss_enterprise_application_platform_expansion_pack:org.apache.struts/struts2-core" }, "product_reference": "org.apache.struts/struts2-core", "relates_to_product_reference": "red_hat_jboss_enterprise_application_platform_expansion_pack" }, { "category": "default_component_of", "full_product_name": { "name": "struts-core as a component of Red Hat JBoss Enterprise Application Platform Expansion Pack", "product_id": "red_hat_jboss_enterprise_application_platform_expansion_pack:struts-core" }, "product_reference": "struts-core", "relates_to_product_reference": "red_hat_jboss_enterprise_application_platform_expansion_pack" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-taglib as a component of Red Hat JBoss Fuse Service Works 6", "product_id": "red_hat_jboss_fuse_service_works_6:org.apache.struts/struts-taglib" }, "product_reference": "org.apache.struts/struts-taglib", "relates_to_product_reference": "red_hat_jboss_fuse_service_works_6" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-tiles as a component of Red Hat JBoss Fuse Service Works 6", "product_id": "red_hat_jboss_fuse_service_works_6:org.apache.struts/struts-tiles" }, "product_reference": "org.apache.struts/struts-tiles", "relates_to_product_reference": "red_hat_jboss_fuse_service_works_6" }, { "category": "default_component_of", "full_product_name": { "name": "struts-core as a component of Red Hat JBoss Fuse Service Works 6", "product_id": "red_hat_jboss_fuse_service_works_6:struts-core" }, "product_reference": "struts-core", "relates_to_product_reference": "red_hat_jboss_fuse_service_works_6" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-taglib as a component of Red Hat JBoss Web Server 5", "product_id": "red_hat_jboss_web_server_5:org.apache.struts/struts-taglib" }, "product_reference": "org.apache.struts/struts-taglib", "relates_to_product_reference": "red_hat_jboss_web_server_5" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-tiles as a component of Red Hat JBoss Web Server 5", "product_id": "red_hat_jboss_web_server_5:org.apache.struts/struts-tiles" }, "product_reference": "org.apache.struts/struts-tiles", "relates_to_product_reference": "red_hat_jboss_web_server_5" }, { "category": "default_component_of", "full_product_name": { "name": "struts-core as a component of Red Hat JBoss Web Server 5", "product_id": "red_hat_jboss_web_server_5:struts-core" }, "product_reference": "struts-core", "relates_to_product_reference": "red_hat_jboss_web_server_5" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-taglib as a component of Red Hat JBoss Web Server 6", "product_id": "red_hat_jboss_web_server_6:org.apache.struts/struts-taglib" }, "product_reference": "org.apache.struts/struts-taglib", "relates_to_product_reference": "red_hat_jboss_web_server_6" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-tiles as a component of Red Hat JBoss Web Server 6", "product_id": "red_hat_jboss_web_server_6:org.apache.struts/struts-tiles" }, "product_reference": "org.apache.struts/struts-tiles", "relates_to_product_reference": "red_hat_jboss_web_server_6" }, { "category": "default_component_of", "full_product_name": { "name": "struts-core as a component of Red Hat JBoss Web Server 6", "product_id": "red_hat_jboss_web_server_6:struts-core" }, "product_reference": "struts-core", "relates_to_product_reference": "red_hat_jboss_web_server_6" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-taglib as a component of Red Hat Process Automation 7", "product_id": "red_hat_process_automation_7:org.apache.struts/struts-taglib" }, "product_reference": "org.apache.struts/struts-taglib", "relates_to_product_reference": "red_hat_process_automation_7" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-tiles as a component of Red Hat Process Automation 7", "product_id": "red_hat_process_automation_7:org.apache.struts/struts-tiles" }, "product_reference": "org.apache.struts/struts-tiles", "relates_to_product_reference": "red_hat_process_automation_7" }, { "category": "default_component_of", "full_product_name": { "name": "struts-core as a component of Red Hat Process Automation 7", "product_id": "red_hat_process_automation_7:struts-core" }, "product_reference": "struts-core", "relates_to_product_reference": "red_hat_process_automation_7" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-taglib as a component of Red Hat Single Sign-On 7", "product_id": "red_hat_single_sign-on_7:org.apache.struts/struts-taglib" }, "product_reference": "org.apache.struts/struts-taglib", "relates_to_product_reference": "red_hat_single_sign-on_7" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-tiles as a component of Red Hat Single Sign-On 7", "product_id": "red_hat_single_sign-on_7:org.apache.struts/struts-tiles" }, "product_reference": "org.apache.struts/struts-tiles", "relates_to_product_reference": "red_hat_single_sign-on_7" }, { "category": "default_component_of", "full_product_name": { "name": "struts-core as a component of Red Hat Single Sign-On 7", "product_id": "red_hat_single_sign-on_7:struts-core" }, "product_reference": "struts-core", "relates_to_product_reference": "red_hat_single_sign-on_7" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-taglib as a component of streams for Apache Kafka", "product_id": "streams_for_apache_kafka:org.apache.struts/struts-taglib" }, "product_reference": "org.apache.struts/struts-taglib", "relates_to_product_reference": "streams_for_apache_kafka" }, { "category": "default_component_of", "full_product_name": { "name": "org.apache.struts/struts-tiles as a component of streams for Apache Kafka", "product_id": "streams_for_apache_kafka:org.apache.struts/struts-tiles" }, "product_reference": "org.apache.struts/struts-tiles", "relates_to_product_reference": "streams_for_apache_kafka" }, { "category": "default_component_of", "full_product_name": { "name": "struts-core as a component of streams for Apache Kafka", "product_id": "streams_for_apache_kafka:struts-core" }, "product_reference": "struts-core", "relates_to_product_reference": "streams_for_apache_kafka" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-53677", "cwe": { "id": "CWE-552", "name": "Files or Directories Accessible to External Parties" }, "discovery_date": "2024-12-11T16:00:38.938871+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "a-mq_clients_2:org.apache.struts/struts-taglib", "a-mq_clients_2:org.apache.struts/struts-tiles", "a-mq_clients_2:struts-core", "red_hat_amq_broker_7:org.apache.struts/struts-taglib", "red_hat_amq_broker_7:org.apache.struts/struts-tiles", "red_hat_amq_broker_7:struts-core", "red_hat_build_of_apache_camel_for_spring_boot_4:org.apache.struts/struts-taglib", "red_hat_build_of_apache_camel_for_spring_boot_4:org.apache.struts/struts-tiles", "red_hat_build_of_apache_camel_for_spring_boot_4:struts-core", "red_hat_build_of_debezium_2:org.apache.struts/struts-taglib", "red_hat_build_of_debezium_2:org.apache.struts/struts-tiles", "red_hat_build_of_debezium_2:struts-core", "red_hat_build_of_keycloak:org.apache.struts/struts-taglib", "red_hat_build_of_keycloak:org.apache.struts/struts-tiles", "red_hat_build_of_keycloak:struts-core", "red_hat_build_of_optaplanner_8:org.apache.struts/struts-taglib", "red_hat_build_of_optaplanner_8:org.apache.struts/struts-tiles", "red_hat_build_of_optaplanner_8:struts-core", "red_hat_data_grid_8:org.apache.struts/struts-taglib", "red_hat_data_grid_8:org.apache.struts/struts-tiles", "red_hat_data_grid_8:struts-core", "red_hat_fuse_7:com.google.inject.extensions/guice-struts2", "red_hat_fuse_7:org.apache.struts.xwork/xwork-core", "red_hat_fuse_7:org.apache.struts/struts-taglib", "red_hat_fuse_7:org.apache.struts/struts-tiles", "red_hat_fuse_7:org.apache.struts/struts2-core", "red_hat_fuse_7:struts-core", "red_hat_integration_camel_k_1:org.apache.struts/struts-taglib", "red_hat_integration_camel_k_1:org.apache.struts/struts-tiles", "red_hat_integration_camel_k_1:struts-core", "red_hat_jboss_data_grid_7:org.apache.struts/struts-taglib", "red_hat_jboss_data_grid_7:org.apache.struts/struts-tiles", "red_hat_jboss_data_grid_7:struts-core", "red_hat_jboss_enterprise_application_platform_7:struts-core", "red_hat_jboss_enterprise_application_platform_8:opentelemetry-javaagent-struts-2.3", "red_hat_jboss_enterprise_application_platform_8:struts-core", "red_hat_jboss_enterprise_application_platform_8:struts-taglib", "red_hat_jboss_enterprise_application_platform_8:struts-tiles", "red_hat_jboss_enterprise_application_platform_8:struts2-core", "red_hat_jboss_enterprise_application_platform_8:xwork-core", "red_hat_jboss_enterprise_application_platform_expansion_pack:io.opentelemetry.javaagent.instrumentation/opentelemetry-javaagent-struts-2.3", "red_hat_jboss_enterprise_application_platform_expansion_pack:org.apache.struts.xwork/xwork-core", "red_hat_jboss_enterprise_application_platform_expansion_pack:org.apache.struts/struts-taglib", "red_hat_jboss_enterprise_application_platform_expansion_pack:org.apache.struts/struts-tiles", "red_hat_jboss_enterprise_application_platform_expansion_pack:org.apache.struts/struts2-core", "red_hat_jboss_enterprise_application_platform_expansion_pack:struts-core", "red_hat_jboss_fuse_service_works_6:org.apache.struts/struts-taglib", "red_hat_jboss_fuse_service_works_6:org.apache.struts/struts-tiles", "red_hat_jboss_fuse_service_works_6:struts-core", "red_hat_jboss_web_server_5:org.apache.struts/struts-taglib", "red_hat_jboss_web_server_5:org.apache.struts/struts-tiles", "red_hat_jboss_web_server_5:struts-core", "red_hat_jboss_web_server_6:org.apache.struts/struts-taglib", "red_hat_jboss_web_server_6:org.apache.struts/struts-tiles", "red_hat_jboss_web_server_6:struts-core", "red_hat_process_automation_7:org.apache.struts/struts-taglib", "red_hat_process_automation_7:org.apache.struts/struts-tiles", "red_hat_process_automation_7:struts-core", "red_hat_single_sign-on_7:org.apache.struts/struts-taglib", "red_hat_single_sign-on_7:org.apache.struts/struts-tiles", "red_hat_single_sign-on_7:struts-core", "streams_for_apache_kafka:org.apache.struts/struts-taglib", "streams_for_apache_kafka:org.apache.struts/struts-tiles", "streams_for_apache_kafka:struts-core" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2331686" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Struts. Affected versions of this package are vulnerable to remote code execution (RCE) via manipulation of the file upload mechanism that enables path traversal. Under certain conditions, uploading a malicious file is possible and may then be executed on the server.", "title": "Vulnerability description" }, { "category": "summary", "text": "struts: org.apache.struts: mixing setters for uploaded files and normal fields can allow bypass file upload checks", "title": "Vulnerability summary" }, { "category": "other", "text": "No Red Hat products are affected by this vulnerability.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_not_affected": [ "a-mq_clients_2:org.apache.struts/struts-taglib", "a-mq_clients_2:org.apache.struts/struts-tiles", "a-mq_clients_2:struts-core", "red_hat_amq_broker_7:org.apache.struts/struts-taglib", "red_hat_amq_broker_7:org.apache.struts/struts-tiles", "red_hat_amq_broker_7:struts-core", "red_hat_build_of_apache_camel_for_spring_boot_4:org.apache.struts/struts-taglib", "red_hat_build_of_apache_camel_for_spring_boot_4:org.apache.struts/struts-tiles", "red_hat_build_of_apache_camel_for_spring_boot_4:struts-core", "red_hat_build_of_debezium_2:org.apache.struts/struts-taglib", "red_hat_build_of_debezium_2:org.apache.struts/struts-tiles", "red_hat_build_of_debezium_2:struts-core", "red_hat_build_of_keycloak:org.apache.struts/struts-taglib", "red_hat_build_of_keycloak:org.apache.struts/struts-tiles", "red_hat_build_of_keycloak:struts-core", "red_hat_build_of_optaplanner_8:org.apache.struts/struts-taglib", "red_hat_build_of_optaplanner_8:org.apache.struts/struts-tiles", "red_hat_build_of_optaplanner_8:struts-core", "red_hat_data_grid_8:org.apache.struts/struts-taglib", "red_hat_data_grid_8:org.apache.struts/struts-tiles", "red_hat_data_grid_8:struts-core", "red_hat_fuse_7:com.google.inject.extensions/guice-struts2", "red_hat_fuse_7:org.apache.struts.xwork/xwork-core", "red_hat_fuse_7:org.apache.struts/struts-taglib", "red_hat_fuse_7:org.apache.struts/struts-tiles", "red_hat_fuse_7:org.apache.struts/struts2-core", "red_hat_fuse_7:struts-core", "red_hat_integration_camel_k_1:org.apache.struts/struts-taglib", "red_hat_integration_camel_k_1:org.apache.struts/struts-tiles", "red_hat_integration_camel_k_1:struts-core", "red_hat_jboss_data_grid_7:org.apache.struts/struts-taglib", "red_hat_jboss_data_grid_7:org.apache.struts/struts-tiles", "red_hat_jboss_data_grid_7:struts-core", "red_hat_jboss_enterprise_application_platform_7:struts-core", "red_hat_jboss_enterprise_application_platform_8:opentelemetry-javaagent-struts-2.3", "red_hat_jboss_enterprise_application_platform_8:struts-core", "red_hat_jboss_enterprise_application_platform_8:struts-taglib", "red_hat_jboss_enterprise_application_platform_8:struts-tiles", "red_hat_jboss_enterprise_application_platform_8:struts2-core", "red_hat_jboss_enterprise_application_platform_8:xwork-core", "red_hat_jboss_enterprise_application_platform_expansion_pack:io.opentelemetry.javaagent.instrumentation/opentelemetry-javaagent-struts-2.3", "red_hat_jboss_enterprise_application_platform_expansion_pack:org.apache.struts.xwork/xwork-core", "red_hat_jboss_enterprise_application_platform_expansion_pack:org.apache.struts/struts-taglib", "red_hat_jboss_enterprise_application_platform_expansion_pack:org.apache.struts/struts-tiles", "red_hat_jboss_enterprise_application_platform_expansion_pack:org.apache.struts/struts2-core", "red_hat_jboss_enterprise_application_platform_expansion_pack:struts-core", "red_hat_jboss_fuse_service_works_6:org.apache.struts/struts-taglib", "red_hat_jboss_fuse_service_works_6:org.apache.struts/struts-tiles", "red_hat_jboss_fuse_service_works_6:struts-core", "red_hat_jboss_web_server_5:org.apache.struts/struts-taglib", "red_hat_jboss_web_server_5:org.apache.struts/struts-tiles", "red_hat_jboss_web_server_5:struts-core", "red_hat_jboss_web_server_6:org.apache.struts/struts-taglib", "red_hat_jboss_web_server_6:org.apache.struts/struts-tiles", "red_hat_jboss_web_server_6:struts-core", "red_hat_process_automation_7:org.apache.struts/struts-taglib", "red_hat_process_automation_7:org.apache.struts/struts-tiles", "red_hat_process_automation_7:struts-core", "red_hat_single_sign-on_7:org.apache.struts/struts-taglib", "red_hat_single_sign-on_7:org.apache.struts/struts-tiles", "red_hat_single_sign-on_7:struts-core", "streams_for_apache_kafka:org.apache.struts/struts-taglib", "streams_for_apache_kafka:org.apache.struts/struts-tiles", "streams_for_apache_kafka:struts-core" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-53677" }, { "category": "external", "summary": "RHBZ#2331686", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331686" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-53677", "url": "https://www.cve.org/CVERecord?id=CVE-2024-53677" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-53677", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53677" }, { "category": "external", "summary": "https://cwiki.apache.org/confluence/display/WW/S2-067", "url": "https://cwiki.apache.org/confluence/display/WW/S2-067" } ], "release_date": "2024-12-11T15:35:43.389000+00:00", "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "a-mq_clients_2:org.apache.struts/struts-taglib", "a-mq_clients_2:org.apache.struts/struts-tiles", "a-mq_clients_2:struts-core", "red_hat_amq_broker_7:org.apache.struts/struts-taglib", "red_hat_amq_broker_7:org.apache.struts/struts-tiles", "red_hat_amq_broker_7:struts-core", "red_hat_build_of_apache_camel_for_spring_boot_4:org.apache.struts/struts-taglib", "red_hat_build_of_apache_camel_for_spring_boot_4:org.apache.struts/struts-tiles", "red_hat_build_of_apache_camel_for_spring_boot_4:struts-core", "red_hat_build_of_debezium_2:org.apache.struts/struts-taglib", "red_hat_build_of_debezium_2:org.apache.struts/struts-tiles", "red_hat_build_of_debezium_2:struts-core", "red_hat_build_of_keycloak:org.apache.struts/struts-taglib", "red_hat_build_of_keycloak:org.apache.struts/struts-tiles", "red_hat_build_of_keycloak:struts-core", "red_hat_build_of_optaplanner_8:org.apache.struts/struts-taglib", "red_hat_build_of_optaplanner_8:org.apache.struts/struts-tiles", "red_hat_build_of_optaplanner_8:struts-core", "red_hat_data_grid_8:org.apache.struts/struts-taglib", "red_hat_data_grid_8:org.apache.struts/struts-tiles", "red_hat_data_grid_8:struts-core", "red_hat_fuse_7:com.google.inject.extensions/guice-struts2", "red_hat_fuse_7:org.apache.struts.xwork/xwork-core", "red_hat_fuse_7:org.apache.struts/struts-taglib", "red_hat_fuse_7:org.apache.struts/struts-tiles", "red_hat_fuse_7:org.apache.struts/struts2-core", "red_hat_fuse_7:struts-core", "red_hat_integration_camel_k_1:org.apache.struts/struts-taglib", "red_hat_integration_camel_k_1:org.apache.struts/struts-tiles", "red_hat_integration_camel_k_1:struts-core", "red_hat_jboss_data_grid_7:org.apache.struts/struts-taglib", "red_hat_jboss_data_grid_7:org.apache.struts/struts-tiles", "red_hat_jboss_data_grid_7:struts-core", "red_hat_jboss_enterprise_application_platform_7:struts-core", "red_hat_jboss_enterprise_application_platform_8:opentelemetry-javaagent-struts-2.3", "red_hat_jboss_enterprise_application_platform_8:struts-core", "red_hat_jboss_enterprise_application_platform_8:struts-taglib", "red_hat_jboss_enterprise_application_platform_8:struts-tiles", "red_hat_jboss_enterprise_application_platform_8:struts2-core", "red_hat_jboss_enterprise_application_platform_8:xwork-core", "red_hat_jboss_enterprise_application_platform_expansion_pack:io.opentelemetry.javaagent.instrumentation/opentelemetry-javaagent-struts-2.3", "red_hat_jboss_enterprise_application_platform_expansion_pack:org.apache.struts.xwork/xwork-core", "red_hat_jboss_enterprise_application_platform_expansion_pack:org.apache.struts/struts-taglib", "red_hat_jboss_enterprise_application_platform_expansion_pack:org.apache.struts/struts-tiles", "red_hat_jboss_enterprise_application_platform_expansion_pack:org.apache.struts/struts2-core", "red_hat_jboss_enterprise_application_platform_expansion_pack:struts-core", "red_hat_jboss_fuse_service_works_6:org.apache.struts/struts-taglib", "red_hat_jboss_fuse_service_works_6:org.apache.struts/struts-tiles", "red_hat_jboss_fuse_service_works_6:struts-core", "red_hat_jboss_web_server_5:org.apache.struts/struts-taglib", "red_hat_jboss_web_server_5:org.apache.struts/struts-tiles", "red_hat_jboss_web_server_5:struts-core", "red_hat_jboss_web_server_6:org.apache.struts/struts-taglib", "red_hat_jboss_web_server_6:org.apache.struts/struts-tiles", "red_hat_jboss_web_server_6:struts-core", "red_hat_process_automation_7:org.apache.struts/struts-taglib", "red_hat_process_automation_7:org.apache.struts/struts-tiles", "red_hat_process_automation_7:struts-core", "red_hat_single_sign-on_7:org.apache.struts/struts-taglib", "red_hat_single_sign-on_7:org.apache.struts/struts-tiles", "red_hat_single_sign-on_7:struts-core", "streams_for_apache_kafka:org.apache.struts/struts-taglib", "streams_for_apache_kafka:org.apache.struts/struts-tiles", "streams_for_apache_kafka:struts-core" ] } ], "threats": [ { "category": "impact", "details": "Critical", "product_ids": [ "a-mq_clients_2:org.apache.struts/struts-taglib", "a-mq_clients_2:org.apache.struts/struts-tiles", "a-mq_clients_2:struts-core", "red_hat_amq_broker_7:org.apache.struts/struts-taglib", "red_hat_amq_broker_7:org.apache.struts/struts-tiles", "red_hat_amq_broker_7:struts-core", "red_hat_build_of_apache_camel_for_spring_boot_4:org.apache.struts/struts-taglib", "red_hat_build_of_apache_camel_for_spring_boot_4:org.apache.struts/struts-tiles", "red_hat_build_of_apache_camel_for_spring_boot_4:struts-core", "red_hat_build_of_debezium_2:org.apache.struts/struts-taglib", "red_hat_build_of_debezium_2:org.apache.struts/struts-tiles", "red_hat_build_of_debezium_2:struts-core", "red_hat_build_of_keycloak:org.apache.struts/struts-taglib", "red_hat_build_of_keycloak:org.apache.struts/struts-tiles", "red_hat_build_of_keycloak:struts-core", "red_hat_build_of_optaplanner_8:org.apache.struts/struts-taglib", "red_hat_build_of_optaplanner_8:org.apache.struts/struts-tiles", "red_hat_build_of_optaplanner_8:struts-core", "red_hat_data_grid_8:org.apache.struts/struts-taglib", "red_hat_data_grid_8:org.apache.struts/struts-tiles", "red_hat_data_grid_8:struts-core", "red_hat_fuse_7:com.google.inject.extensions/guice-struts2", "red_hat_fuse_7:org.apache.struts.xwork/xwork-core", "red_hat_fuse_7:org.apache.struts/struts-taglib", "red_hat_fuse_7:org.apache.struts/struts-tiles", "red_hat_fuse_7:org.apache.struts/struts2-core", "red_hat_fuse_7:struts-core", "red_hat_integration_camel_k_1:org.apache.struts/struts-taglib", "red_hat_integration_camel_k_1:org.apache.struts/struts-tiles", "red_hat_integration_camel_k_1:struts-core", "red_hat_jboss_data_grid_7:org.apache.struts/struts-taglib", "red_hat_jboss_data_grid_7:org.apache.struts/struts-tiles", "red_hat_jboss_data_grid_7:struts-core", "red_hat_jboss_enterprise_application_platform_7:struts-core", "red_hat_jboss_enterprise_application_platform_8:opentelemetry-javaagent-struts-2.3", "red_hat_jboss_enterprise_application_platform_8:struts-core", "red_hat_jboss_enterprise_application_platform_8:struts-taglib", "red_hat_jboss_enterprise_application_platform_8:struts-tiles", "red_hat_jboss_enterprise_application_platform_8:struts2-core", "red_hat_jboss_enterprise_application_platform_8:xwork-core", "red_hat_jboss_enterprise_application_platform_expansion_pack:io.opentelemetry.javaagent.instrumentation/opentelemetry-javaagent-struts-2.3", "red_hat_jboss_enterprise_application_platform_expansion_pack:org.apache.struts.xwork/xwork-core", "red_hat_jboss_enterprise_application_platform_expansion_pack:org.apache.struts/struts-taglib", "red_hat_jboss_enterprise_application_platform_expansion_pack:org.apache.struts/struts-tiles", "red_hat_jboss_enterprise_application_platform_expansion_pack:org.apache.struts/struts2-core", "red_hat_jboss_enterprise_application_platform_expansion_pack:struts-core", "red_hat_jboss_fuse_service_works_6:org.apache.struts/struts-taglib", "red_hat_jboss_fuse_service_works_6:org.apache.struts/struts-tiles", "red_hat_jboss_fuse_service_works_6:struts-core", "red_hat_jboss_web_server_5:org.apache.struts/struts-taglib", "red_hat_jboss_web_server_5:org.apache.struts/struts-tiles", "red_hat_jboss_web_server_5:struts-core", "red_hat_jboss_web_server_6:org.apache.struts/struts-taglib", "red_hat_jboss_web_server_6:org.apache.struts/struts-tiles", "red_hat_jboss_web_server_6:struts-core", "red_hat_process_automation_7:org.apache.struts/struts-taglib", "red_hat_process_automation_7:org.apache.struts/struts-tiles", "red_hat_process_automation_7:struts-core", "red_hat_single_sign-on_7:org.apache.struts/struts-taglib", "red_hat_single_sign-on_7:org.apache.struts/struts-tiles", "red_hat_single_sign-on_7:struts-core", "streams_for_apache_kafka:org.apache.struts/struts-taglib", "streams_for_apache_kafka:org.apache.struts/struts-tiles", "streams_for_apache_kafka:struts-core" ] } ], "title": "struts: org.apache.struts: mixing setters for uploaded files and normal fields can allow bypass file upload checks" } ] }