CVE-2008-6505: Path Traversal
Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.
Other sources
Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.struts:struts2-coreto a version that resolves this vulnerability.Fixed in 2.1.3 - Upgrade
Upgrade
maven/org.apache.struts:struts2-coreto a version that resolves this vulnerability.Fixed in 2.0.12
Event History
Frequently Asked Questions
What is the severity of CVE-2008-6505?
CVE-2008-6505 is considered a critical vulnerability that allows remote attackers to exploit directory traversal and read arbitrary files.
How do I fix CVE-2008-6505?
To fix CVE-2008-6505, upgrade Apache Struts to version 2.0.12 or 2.1.3 or later.
Which versions of Apache Struts are affected by CVE-2008-6505?
CVE-2008-6505 affects Apache Struts versions 2.0.6 to 2.0.11.2 and all versions of 2.0.x prior to 2.0.12.
Can CVE-2008-6505 be exploited remotely?
Yes, CVE-2008-6505 can be exploited remotely by attackers through crafted URIs.
What are the symptoms of exploitation of CVE-2008-6505?
Exploitation of CVE-2008-6505 may result in unauthorized file access on the server, potentially exposing sensitive information.