CVE-2023-50164

unknowncovered by 1 sourcefirst seen 2023-12-13

On December 4, 2023, Apache published a security advisory regarding the critical vulnerability CVE-2023-50164 affecting the Struts 2 framework. This vulnerability allows an unauthenticated attacker to upload a backdoor to a vulnerable server, thus executing arbitrary code...

CSIRTS triage

What: The vulnerability allows an unauthenticated attacker to upload a backdoor to a vulnerable server, thus executing arbitrary code.
Who is affected: Deployments of Apache Struts 2 that are vulnerable.
Urgency: Remediation is urgent due to the critical nature of the vulnerability.
Action: Apply the security patch provided by Apache.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2023-50164

Get an email if CVE-2023-50164 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Exploitation likely imminentEPSS puts this in the most-targeted tier (80.8% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 100% of all EPSS-scored CVEs.

Advisory coverage (1)

unknownVulnerability in Apache Struts 2 (December 13, 2023)cert-fr-alerte · 2023-12-13

External references

NVD record for CVE-2023-50164

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2023-50164 status](https://www.csirts.com/badge/CVE-2023-50164)](https://www.csirts.com/cve/CVE-2023-50164)