{"basis":"claimed","id":"CVE-2024-53677","name":"Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks","vendorProject":"Apache Software Foundation","product":"Apache Struts","publishedAt":"2024-12-11","cvss":{"score":9.5,"severity":"CRITICAL","version":"4.0"},"exploited":null,"epss":{"score":0.72367,"percentile":0.99438,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"blocks","firstOn":"2025-01-13","daysToRule":33},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2025-01-21","daysToRule":41},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks","description":"File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.\n\nThis issue affects Apache Struts: from 2.0.0 before 6.4.0.\n\nUsers are recommended to upgrade to version 6.4.0 at least and migrate to the new  file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.\n\nYou can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067","cwes":[],"vendors":[{"vendor":"cloudflare","status":"blocks","basis":"claimed","firstOn":"2025-01-13","firstIsNew":true,"daysToRule":33,"daysAtMost":null,"freePlan":false,"claims":[{"id":"437edaae5a1158d617469aac9c21370d5943ec1d934da941889ca53e03af2276","cve_id":"CVE-2024-53677","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"f40ce742be534ba19d610961ce6311bb","rule_name":"Apache Struts - Remote Code Execution - CVE:CVE-2024-53677","change":"new","default_action":"Block","published_on":"2025-01-13","source_url":"https://developers.cloudflare.com/changelog/post/2025-01-13-waf-release/","source_title":"WAF Release - 2025-01-13","excerpt":"Apache Struts - Remote Code Execution - CVE:CVE-2024-53677. Previous action: Log. New action: Block. New Detection","first_seen_at":"2026-11-02T21:00:16.956Z"}]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2025-01-21","firstIsNew":true,"daysToRule":41,"daysAtMost":null,"freePlan":false,"claims":[{"id":"fc5982d28647fe725dce75554e3090c3c175898f984ece740817afacf6ecd3d5","cve_id":"CVE-2024-53677","vendor":"f5","product":"Attack signatures","rule_id":"200007081","rule_name":"Apache Struts 2 File Upload","change":"new","default_action":null,"published_on":"2025-01-21","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200007081 \"Apache Struts 2 File Upload\" (Path Traversal, risk High), systems: Apache Struts. References: CVE-2024-53677.","first_seen_at":"2026-11-02T21:00:26.849Z"},{"id":"d1a44666b9250844acb940fdcafa2764fc99e687fba2f973c3336d25ef773891","cve_id":"CVE-2024-53677","vendor":"f5","product":"Attack signatures","rule_id":"200007081","rule_name":"Apache Struts 2 File Upload","change":"new","default_action":null,"published_on":"2025-03-11","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200007081 \"Apache Struts 2 File Upload\" (Path Traversal, risk High), systems: Apache Struts. References: CVE-2024-53677.","first_seen_at":"2026-11-02T21:00:26.672Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T21:17:16.628Z","cvssVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:A/V:C/RE:L/U:Red","ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total"},"measured":[],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0},{"day":"2026-11-03","posts":0}],"top_posts":[],"exploit_repositories":[]}}