VulnerabilityModified
CVE-2019-0233
An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.
HIGH 7.5EPSS 68.0%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 68.0%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 68.05% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-281
- Affected
- apache/struts · oracle/communications policy management · oracle/financial services data integration hub · oracle/financial services market risk measurement and management · oracle/mysql enterprise monitor
- Source
- security@apache.org
References
- https://cwiki.apache.org/confluence/display/ww/s2-060Vendor Advisory
- https://launchpad.support.sap.com/#/notes/2982840Permissions Required, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
- https://cwiki.apache.org/confluence/display/ww/s2-060Vendor Advisory
- https://launchpad.support.sap.com/#/notes/2982840Permissions Required, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.