Apache Struts
An open-source Java web application framework under the Apache Software Foundation that follows the MVC architectural pattern and is used to build enterprise Java web applications; it has historically had multiple severe remote code execution vulnerabilities.
Timeline (last 90 days)
The affected products involved in the five newly added vulnerabilities are: the ProFTPD file read/write vulnerability (severity 10.0), ONLYOFFICE Docs path traversal (9.8), Apache Struts command injection (8.1), BIND denial of service (7.5), and Strapi plaintext exposure (7.2).
The command injection vulnerability in Apache Struts depends on the Dynamic Method Invocation configuration switch, and the actual scope of impact is determined by that configuration.
The fixed version requirements for the five vulnerabilities are: BIND 9.9.7-P2 or 9.10.2-P3 and higher, ProFTPD 1.3.5a or disabling mod_copy, Apache Struts 2.3.20.3/2.3.24.3/2.3.28.1, ONLYOFFICE 5.6.3 and higher, and Strapi 4.8.0 and higher.
All Facts (3)
The affected products involved in the five newly added vulnerabilities are: the ProFTPD file read/write vulnerability (severity 10.0), ONLYOFFICE Docs path traversal (9.8), Apache Struts command injection (8.1), BIND denial of service (7.5), and Strapi plaintext exposure (7.2).
50%UnverifiedThe command injection vulnerability in Apache Struts depends on the Dynamic Method Invocation configuration switch, and the actual scope of impact is determined by that configuration.
50%UnverifiedThe fixed version requirements for the five vulnerabilities are: BIND 9.9.7-P2 or 9.10.2-P3 and higher, ProFTPD 1.3.5a or disabling mod_copy, Apache Struts 2.3.20.3/2.3.24.3/2.3.28.1, ONLYOFFICE 5.6.3 and higher, and Strapi 4.8.0 and higher.
50%