Apaches Patches Two Vulnerabilities in Struts Including Potential Remote Code Execution (CVE-2019-0230)

The Apache Struts Security Team recently published security bulletins to address CVE-2019-0230 and CVE-2019-0233, two vulnerabilities in Apache Struts version 2. 

Of the two flaws, CVE-2019-0230 is the most severe as there is potential for remote code execution through exploitation of this vulnerability. However, exploitation is not so straightforward, as each Struts application is unique, which means an attacker would need to craft their attacks to each vulnerable server. There are already multiple proof-of-concept code snippets in circulation that reportedly exploit this vulnerability. 

For more information about these vulnerabilities, including the availability of patches and Tenable product coverage, please visit our blog.