5.0med
CVE-2008-65051 exploit
Apache Struts directory traversal vulnerability
Also known as GHSA-wv7g-xhvw-8hcp
Published 17 y ago · modified 4 mo ago · JSON
CVSS
5.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
72.7%
percentile 99%
Public exploits
1
Exploit-DB
Summary
Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.
Exploit prediction (EPSS)
72.71% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.
Exploits and detections
- EDB-32565 Struts 2.0.11 - Multiple Directory Traversal Vulnerabilities · remote · 2008-11-04
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.struts:struts2-core | >=2.0.0, <2.0.12 >=2.1.0, <2.1.3 | 2.0.12 2.1.3 |
Classification
- Weakness
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
- issues.apache.org /struts/browse/WW-2779 · x_refsource_CONFIRM, x_transferred
- struts.apache.org /2.x/docs/s2-004.html · x_refsource_CONFIRM, x_transferred
- vupen.com /english/advisories/2008/3003 · vdb-entry, x_refsource_VUPEN, x_transferred
- secunia.com /advisories/32497 · third-party-advisory, x_refsource_SECUNIA, x_transferred
- securityfocus.com /bid/32104 · vdb-entry, x_refsource_BID, x_transferred
- osvdb.org /49733 · vdb-entry, x_refsource_OSVDB, x_transferred
- osvdb.org /49734 · vdb-entry, x_refsource_OSVDB, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2008-6505 · advisory
- github.com /apache/struts/commit/04fcefa44bae1263c7cad6986a9dafed67f0164f · web
- github.com /apache/struts/commit/1f1c996eb1f0f3e2193fba0075f62ccd04e3c0c3 · web
- github.com /apache/struts · package
- web.archive.org /web/20081208214512/http://secunia.com/advisories/32497 · web
- web.archive.org /web/20111025094319/http://www.securityfocus.com/bid/32104 · web
Sources
- CVE List: CVE-2008-6505
- GitHub Advisory: GHSA-wv7g-xhvw-8hcp
- NVD: CVE-2008-6505
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.