Shulou(Shulou.com)05/31 Report--

This article mainly analyzes the relevant knowledge points of the example analysis of the notification of Apache Struts2 S2-057 security vulnerabilities by CNNVD. The content is detailed and easy to understand, and the operation details are reasonable, which has a certain reference value. If you are interested, you might as well follow the editor to take a look, and follow the editor to learn more about the "CNNVD example analysis of Apache Struts2 S2-057 security vulnerabilities notification".

Currently, Apache has officially released a version update to fix this vulnerability. Users are advised to confirm the Apache Struts product version in time, and if affected, please take remedial measures in time.

I. introduction of loopholes

Apache Struts2 is a sub-project of the Jakarta project of the Apache Software Foundation in the United States. It is a Web application framework designed based on MVC.

Apache officially released Apache Struts2 S2-057 security vulnerabilities (CNNVD-201808-740, CVE-2018-11776) on August 22nd, 2018. Remote code execution vulnerabilities are triggered when pan-namespace functionality is enabled in the struts2 development framework and specific result is used.

II. Harmful effects

An attacker who successfully exploits this vulnerability can execute malicious code on the target system. Apache Struts2.3-Apache Struts2.3.34, Apache Struts2.5-Apache Struts 2.5.16, etc., are affected by this vulnerability.

III. Suggestions for restoration

Currently, Apache has officially released a version update to fix this vulnerability. Users are advised to confirm the Apache Struts product version in time, and if affected, please take remedial measures in time. The vulnerability remediation measures are as follows:

Upgrade to struts2 2.3.35 or struts2 2.5.17

On the "CNNVD on Apache Struts2 S2-057 security vulnerabilities notification example analysis" is introduced here, more relevant content can search the previous article, hope to help you answer questions, please support the website!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.