CVE-2024-53677

Name: CVE-2024-53677
Creator: NVD / NIST
Published: 2024-12-11T16:15:14.593+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.5/10EPSS 78.20%

Last modified Jun 17, 2026

CVE-2024-53677 is a critical-severity vulnerability rated 9.5/10 on the CVSS scale. File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe. You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067. EPSS estimates a 78.20% chance of exploitation in the next 30 days.

Description

File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe. You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 4.0

9.5/10

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:C/RE:L/U:Red

EPSS Probability

78.20%

99.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-434

Affected Software

Vendor	Product	Versions
Apache	Struts	>= 2.0.0, < 6.4.0

References

https://cwiki.apache.org/confluence/display/WW/S2-067Third Party Advisory
https://security.netapp.com/advisory/ntap-20250103-0005/Third Party Advisory

Timeline

Published: Dec 11, 2024
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2024-53677?

How severe is CVE-2024-53677?

CVE-2024-53677 has a CVSS score of 9.5/10 (CRITICAL severity). The EPSS model estimates a 78.20% probability of exploitation in the next 30 days.

How do I fix CVE-2024-53677?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2024-53677?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST