CVE-2017-5638

Summary

CVE-2017-5638 is a vulnerability affecting the Jakarta Multipart parser in Apache Struts 2 versions 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1. This issue arises from incorrect exception handling and error message generation during file uploads. Maliciously crafted HTTP headers, specifically Content-Type, Content-Disposition, or Content-Length, can exploit this flaw to execute arbitrary commands on the targeted system. This vulnerability was actively exploited in the wild in March 2017.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.