File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe. You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067

Apache Struts 2 has been targeted in past exploitation. As a public proof-of-concept is available and exploitation attempts are underway, immediate patching is recommended

Apache Struts 2 vulnerabilities have been targeted in the past. While no current evidence of exploitation, Tenable is carefully monitoring developments for this vulnerability

The version of SAP BusinessObjects Business Intelligence Platform installed on the remote host is prior to 2025 SP000 000000, 4.3 SP004 001300, or 4.3 SP005 000000. It is, therefore, affected by a vulnerability as referenced in the 3565279 advisory. The file upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform remote code execution.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable
    paths traversal and under some circumstances this can lead to uploading a malicious file which can be used
    to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are
    recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism
    https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic
    based on FileuploadInterceptor your application is safe. You can find more details in
    https://cwiki.apache.org/confluence/display/WW/S2-067 (CVE-2024-53677)

Apache Struts versions prior to 6.4.0 are vulnerable to an upload logic flaw allowing an attacker to manipulate file upload parameters to enable path traversal and under some circumstances this can lead to a remote code execution.

The version of Apache Struts installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the S2-067 advisory.

  - File upload logic is flawed vulnerability in Apache Struts. This issue affects Apache Struts: from 2.0.0     before 6.4.0. Users are recommended to upgrade to version 6.4.0 migrate to the new file upload mechanism     https://struts.apache.org/core-developers/file-upload . You can find more details in     https://cwiki.apache.org/confluence/display/WW/S2-067 (CVE-2024-53677)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
241998	SAP BusinessObjects Business Intelligence Platform Insecure File Operations Vulnerability (3565279)	Nessus	Windows	high
409907	SCA: security update for org.apache.struts:struts2-core (GHSA-43mq-6xmg-29vm)	Tenable Cloud Security	SCA Checks	critical
409907	SCA: security update for org.apache.struts:struts2-core (GHSA-43mq-6xmg-29vm)	Tenable Self-Hosted Container Security	SCA Checks	critical
114549	Apache Struts < 6.4.0 Unrestricted File Upload (S2-067)	Web App Scanning	Component Vulnerability	critical
213040	Apache Struts 2.0.0 <=> 2.3.37(EOL) / 2.5.0 <=> 2.5.33 / 6.0.0 <=> 6.3.0.2 Remote Code Execution (S2-067)	Nessus	Misc.	critical

Detections

Analytics

CVE-2024-53677

critical

Tenable Plugins

high

critical

critical

critical

critical