{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Struts versions ant\u00e9rieures \u00e0 6.1.1",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "L\u2019\u00e9diteur indique les versions 2.0.x et 2.5.x sont en fin de vie et ne b\u00e9n\u00e9ficient plus de mises \u00e0 jour de s\u00e9curit\u00e9.",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-68493",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68493"
    }
  ],
  "initial_release_date": "2026-01-16T00:00:00",
  "last_revision_date": "2026-01-16T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0060",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-01-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Struts. Elle permet \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF).",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Struts",
  "vendor_advisories": [
    {
      "published_at": "2025-12-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Struts s2-069",
      "url": "https://cwiki.apache.org/confluence/display/WW/s2-069"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Struts versions ant\u00e9rieures \u00e0 6.8.0",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Struts versions 7.x ant\u00e9rieures \u00e0 7.1.1",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-64775",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-64775"
    }
  ],
  "initial_release_date": "2025-12-05T00:00:00",
  "last_revision_date": "2025-12-05T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-1067",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-12-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Struts. Elle permet \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Struts",
  "vendor_advisories": [
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Struts s2-068",
      "url": "https://cwiki.apache.org/confluence/display/WW/s2-068"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Struts versions ant\u00e9rieures \u00e0 6.4.0",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-53677",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-53677"
    }
  ],
  "initial_release_date": "2024-12-11T00:00:00",
  "last_revision_date": "2024-12-11T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-1066",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-12-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Struts. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Struts",
  "vendor_advisories": [
    {
      "published_at": "2024-11-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Struts s2-067",
      "url": "https://cwiki.apache.org/confluence/display/WW/s2-067"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Struts versions 2.x ant\u00e9rieures \u00e0 2.5.33",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Struts versions 6.x ant\u00e9rieures \u00e0 6.3.0.2",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-50164",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-50164"
    }
  ],
  "initial_release_date": "2023-12-07T00:00:00",
  "last_revision_date": "2023-12-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-1005",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-12-07T00:00:00.000000"
    },
    {
      "description": "Modification des versions affect\u00e9es par la vuln\u00e9rabilit\u00e9 CVE-2023-50164",
      "revision_date": "2023-12-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Struts 2. Elle permet \u00e0\nun attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Struts 2",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Struts 2 s2-066 du 04 d\u00e9cembre 2023",
      "url": "https://cwiki.apache.org/confluence/display/WW/s2-066"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Struts versions ant\u00e9rieures \u00e0 6.1.2.2",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Struts versions ant\u00e9rieures \u00e0 2.5.32",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Struts versions ant\u00e9rieures \u00e0 6.3.0.1",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-41835",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41835"
    }
  ],
  "initial_release_date": "2023-09-14T00:00:00",
  "last_revision_date": "2023-09-14T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0750",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-09-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache\u003cspan class=\"textit\"\u003e\nStruts\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer un d\u00e9ni de\nservice \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Struts",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Struts s2-065 du 13 septembre 2023",
      "url": "https://cwiki.apache.org/confluence/display/WW/s2-065"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Struts 2 versions ant\u00e9rieures \u00e0 2.5.31",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Struts 2 versions ant\u00e9rieures \u00e0 6.1.2",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-34396",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34396"
    },
    {
      "name": "CVE-2023-34149",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34149"
    }
  ],
  "initial_release_date": "2023-06-14T00:00:00",
  "last_revision_date": "2023-06-14T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0456",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-06-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Apache Struts 2.\nElles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0\ndistance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apache Struts 2",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache s2-064 du 13 juin 2023",
      "url": "https://cwiki.apache.org/confluence/display/WW/s2-064"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache s2-063 du 13 juin 2023",
      "url": "https://cwiki.apache.org/confluence/display/WW/s2-063"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Struts versions ant\u00e9rieures \u00e0 2.5.30",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-31805",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31805"
    },
    {
      "name": "CVE-2020-17530",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-17530"
    }
  ],
  "initial_release_date": "2022-04-13T00:00:00",
  "last_revision_date": "2022-04-19T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-332",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-04-13T00:00:00.000000"
    },
    {
      "description": "Modification du num\u00e9ro CVE",
      "revision_date": "2022-04-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couvertes dan Apache Struts. Elle permet \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Struts",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache s2-062 du 12 avril 2022",
      "url": "https://cwiki.apache.org/confluence/display/WW/s2-062"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Struts 2.x versions ant\u00e9rieures \u00e0 2.5.26",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\n**Important** : l\u0027\u00e9diteur de Struts d\u00e9conseille fortement l\u0027\u00e9valuation\nforc\u00e9e d\u0027expression OGNL sur des donn\u00e9es utilisateurs \\[1\\].\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-17530",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-17530"
    }
  ],
  "initial_release_date": "2020-12-10T00:00:00",
  "last_revision_date": "2020-12-10T00:00:00",
  "links": [
    {
      "title": "[1] R\u00e8gles de s\u00e9curit\u00e9 pour Struts",
      "url": "https://struts.apache.org/security/#do-not-use-incoming-untrusted-user-input-in-forced-expression-evaluation"
    }
  ],
  "reference": "CERTFR-2020-AVI-812",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-12-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Struts. Elle permet \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Struts",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Struts S2-061 du 08 d\u00e9cembre 2020",
      "url": "https://cwiki.apache.org/confluence/display/WW/s2-061"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Struts versions ant\u00e9rieures \u00e0 2.5.22 ou lorsque les bonnes pratiques de filtrage des entr\u00e9es utilisateurs ne sont pas respect\u00e9es.",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-0230",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0230"
    }
  ],
  "initial_release_date": "2020-08-14T00:00:00",
  "last_revision_date": "2020-08-14T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-509",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-08-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Struts. Elle permet \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Struts",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache s2-059 du 13 ao\u00fbt 2020",
      "url": "https://cwiki.apache.org/confluence/display/WW/s2-059"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Struts versions ant\u00e9rieures \u00e0 2.5.22",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-0233",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0233"
    }
  ],
  "initial_release_date": "2020-08-13T00:00:00",
  "last_revision_date": "2020-08-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-505",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-08-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Struts. Elle permet \u00e0 un\nattaquant de provoquer un d\u00e9ni de service \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Struts",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache s2-060 du 11 ao\u00fbt 2020",
      "url": "https://cwiki.apache.org/confluence/display/WW/s2-060"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Struts versions ant\u00e9rieures \u00e0 2.5.17",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Struts versions ant\u00e9rieures \u00e0 2.3.35",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2008-6505",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-6505"
    },
    {
      "name": "CVE-2017-12611",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-12611"
    },
    {
      "name": "CVE-2014-0113",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-0113"
    },
    {
      "name": "CVE-2016-6795",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-6795"
    },
    {
      "name": "CVE-2017-9791",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-9791"
    },
    {
      "name": "CVE-2012-0391",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-0391"
    },
    {
      "name": "CVE-2013-1965",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-1965"
    },
    {
      "name": "CVE-2014-0116",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-0116"
    },
    {
      "name": "CVE-2012-0394",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-0394"
    },
    {
      "name": "CVE-2014-0094",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-0094"
    },
    {
      "name": "CVE-2017-9793",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-9793"
    },
    {
      "name": "CVE-2016-4465",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-4465"
    },
    {
      "name": "CVE-2016-8738",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-8738"
    },
    {
      "name": "CVE-2014-0112",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-0112"
    },
    {
      "name": "CVE-2008-6504",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-6504"
    },
    {
      "name": "CVE-2013-1966",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-1966"
    }
  ],
  "initial_release_date": "2019-08-20T00:00:00",
  "last_revision_date": "2019-08-20T00:00:00",
  "links": [],
  "reference": "CERTFR-2019-AVI-403",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-08-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Apache Struts.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apache Struts",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache s2-058 du 12 ao\u00fbt 2019",
      "url": "https://cwiki.apache.org/confluence/display/WW/s2-058"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Struts versions 2.3.36 et ant\u00e9rieures",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2016-1000031",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-1000031"
    }
  ],
  "initial_release_date": "2018-11-06T00:00:00",
  "last_revision_date": "2018-11-06T00:00:00",
  "links": [],
  "reference": "CERTFR-2018-AVI-531",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2018-11-06T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Struts. Elle permet \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Struts",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache du 5 novembre 2018",
      "url": "http://mail-archives.us.apache.org/mod_mbox/www-announce/201811.mbox/%3CCAMopvkMo8WiP%3DfqVQuZ1Fyx%3D6CGz0Epzfe0gG5XAqP1wdJCoBQ%40mail.gmail.com%3E"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Struts versions ant\u00e9rieures \u00e0 2.3.35",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Struts versions 2.5.x ant\u00e9rieures \u00e0 2.5.17",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2018-11776",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-11776"
    }
  ],
  "initial_release_date": "2018-08-23T00:00:00",
  "last_revision_date": "2018-08-24T00:00:00",
  "links": [],
  "reference": "CERTFR-2018-AVI-405",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2018-08-23T00:00:00.000000"
    },
    {
      "description": "Modification du titre",
      "revision_date": "2018-08-24T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Struts 2 . Elle permet \u00e0\nun attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Struts 2",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Struts 2 S2-057 du 22 ao\u00fbt 2018",
      "url": "https://cwiki.apache.org/confluence/display/WW/S2-057"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Struts 2 versions 2.1.1 \u00e0 2.5.14.1",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2018-1327",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-1327"
    }
  ],
  "initial_release_date": "2018-03-28T00:00:00",
  "last_revision_date": "2018-03-28T00:00:00",
  "links": [],
  "reference": "CERTFR-2018-AVI-153",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2018-03-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Struts 2. Elle permet \u00e0\nun attaquant de provoquer un d\u00e9ni de service \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Struts 2",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache S2-056 du 27 mars 2018",
      "url": "https://cwiki.apache.org/confluence/display/WW/S2-056"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Struts versions ant\u00e9rieures \u00e0 2.5.14.1",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2017-7525",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-7525"
    }
  ],
  "initial_release_date": "2017-12-14T00:00:00",
  "last_revision_date": "2017-12-14T00:00:00",
  "links": [],
  "reference": "CERTFR-2017-AVI-470",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2017-12-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Struts 2. Elle permet \u00e0\nun attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Struts 2",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache s2-055 du 12 d\u00e9cembre 2017",
      "url": "https://cwiki.apache.org/confluence/display/WW/s2-055"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Struts 2 versions ant\u00e9rieures \u00e0 2.5.14.1",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2017-15707",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-15707"
    },
    {
      "name": "CVE-2017-7525",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-7525"
    }
  ],
  "initial_release_date": "2017-12-05T00:00:00",
  "last_revision_date": "2017-12-05T00:00:00",
  "links": [],
  "reference": "CERTFR-2017-AVI-445",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2017-12-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Apache Struts 2.\nElles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non\nsp\u00e9cifi\u00e9 par l\u0027\u00e9diteur et un d\u00e9ni de service \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apache Struts 2",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache S2-054 du 01 d\u00e9cembre 2017",
      "url": "https://cwiki.apache.org/confluence/display/WW/S2-054"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache S2-055 du 01 d\u00e9cembre 2017",
      "url": "https://cwiki.apache.org/confluence/display/WW/s2-055"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Struts versions 2.5.x ant\u00e9rieures \u00e0 2.5.10.1",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Struts versions 2.3.x ant\u00e9rieures \u00e0 2.3.32",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2017-5638",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-5638"
    }
  ],
  "initial_release_date": "2017-03-09T00:00:00",
  "last_revision_date": "2017-03-09T00:00:00",
  "links": [],
  "reference": "CERTFR-2017-AVI-071",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2017-03-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans \u003cspan class=\"textit\"\u003eApache\nStruts\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Struts",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache S2-045 du 06 mars 2017",
      "url": "https://cwiki.apache.org/confluence/display/WW/S2-045"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Struts 2.3.16 et versions ant\u00e9rieures",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Struts 2.0.0 et versions ant\u00e9rieures",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2014-0050",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-0050"
    },
    {
      "name": "CVE-2014-0094",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-0094"
    }
  ],
  "initial_release_date": "2014-03-10T00:00:00",
  "last_revision_date": "2014-03-10T00:00:00",
  "links": [],
  "reference": "CERTFR-2014-AVI-111",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2014-03-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eApache Struts\u003c/span\u003e. Elles permettent \u00e0 un attaquant de\nprovoquer un d\u00e9ni de service \u00e0 distance et un contournement de la\npolitique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apache Struts",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache S2-020 du 07 mars 2014",
      "url": "http://struts.apache.org/release/2.3.x/docs/s2-020.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Struts versions 2.0.0 \u00e0 2.1.8.1 ;",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "VMware vCenter Orchestrator 4.0 et 4.1.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne erreur dans l\u0027\u00e9valuation des param\u00e8tres des requ\u00eates au serveur par\nle module XWork, inclus dans Struts, permet \u00e0 un attaquant d\u0027ex\u00e9cuter du\ncode arbitraire \u00e0 distance. Cette vuln\u00e9rabilit\u00e9 affecte \u00e9galement le\nlogiciel VMware vCenter Orchestrator.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2010-1870",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-1870"
    }
  ],
  "initial_release_date": "2011-01-12T00:00:00",
  "last_revision_date": "2011-03-17T00:00:00",
  "links": [
    {
      "title": "Article KB de Vmware 1034175 du 16 mars 2011 :",
      "url": "http://kb.vmware.com/selfservice/microsites/search.do?language=en_US\u0026cmd=displayKC\u0026externalId=1034175"
    }
  ],
  "reference": "CERTA-2011-AVI-011",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2011-01-12T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences concernant VMware vCO.",
      "revision_date": "2011-03-17T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans \u003cspan class=\"textit\"\u003eStruts\u003c/span\u003e version 2\npermet \u00e0 un attaquant d\u0027ex\u00e9cuter du code Java \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Struts",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Struts S2-005 du 16 Ao\u00fbt 2010",
      "url": "http://struts.apache.org/2.2.1/docs/s2-005.html"
    },
    {
      "published_at": null,
      "title": "Article KB de VMware 1034175 du 16 mars 2011",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Struts versions 2.x ant\u00e9rieures \u00e0 2.5.33",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Struts versions 6.x ant\u00e9rieures \u00e0 6.3.0.2",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "closed_at": "2024-02-16",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-50164",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-50164"
    }
  ],
  "initial_release_date": "2023-12-13T00:00:00",
  "last_revision_date": "2024-02-16T00:00:00",
  "links": [
    {
      "title": "Avis CERT-FR CERTFR-2023-AVI-1005 du 07 d\u00e9cembre 2023",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2023-AVI-1005/"
    }
  ],
  "reference": "CERTFR-2023-ALE-013",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-12-13T00:00:00.000000"
    },
    {
      "description": "Cl\u00f4ture de l\u0027alerte. Cela ne signifie pas la fin d\u0027une menace. Seule l\u0027application de la mise \u00e0 jour permet de vous pr\u00e9munir contre l\u0027exploitation de la vuln\u00e9rabilit\u00e9 correspondante.",
      "revision_date": "2024-02-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "\u003cspan id=\"p14\"\u003eLe 4 d\u00e9cembre 2023, Apache a publi\u00e9 un avis de s\u00e9curit\u00e9\nconcernant la vuln\u00e9rabilit\u00e9 critique \u003cspan id=\"19\"\nclass=\"s-rg\"\u003eCVE-2023-50164\u003c/span\u003e concernant le cadriciel \u003cspan id=\"20\"\nclass=\"s-rg\"\u003eStruts\u003c/span\u003e 2.\u003c/span\u003e\u003cspan id=\"p15\"\u003e Cette vuln\u00e9rabilit\u00e9\npermet \u00e0 un attaquant non authentifi\u00e9 de t\u00e9l\u00e9verser une porte d\u00e9rob\u00e9e\nsur un serveur vuln\u00e9rable, et ainsi ex\u00e9cuter du code arbitraire \u00e0\ndistance.\u003c/span\u003e\n\n\u003cspan id=\"p16\"\u003eLe 12 d\u00e9cembre 2023, un premier code d\u0027exploitation a \u00e9t\u00e9\npubli\u00e9 publiquement et l\u003c/span\u003e\u003cspan id=\"p17\"\u003ee \u003cspan id=\"21\"\nclass=\"s-rg\"\u003eCERT-FR\u003c/span\u003e a connaissance de tentatives\nd\u0027exploitation.\u003c/span\u003e\n\n\u003cspan id=\"p18\"\u003eIl est urgent d\u0027effectuer la mise \u00e0 jour des applications\ns\u0027appuyant sur le cadriciel Struts dans les plus brefs d\u00e9lais, car le\n\u003cspan id=\"24\"\u003eCERT-FR\u003c/span\u003e anticipe des tentatives d\u0027exploitation en\nmasse de la vuln\u00e9rabilit\u00e9 \u003cspan id=\"25\"\u003eCVE-2023-50164\u003c/span\u003e.\u003c/span\u003e\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Struts 2",
  "vendor_advisories": [
    {
      "published_at": "2023-12-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Struts 2 s2-066",
      "url": "https://cwiki.apache.org/confluence/display/WW/s2-066"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Branche 2.3 de Struts jusqu\u0027\u00e0 la version 2.3.34",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Les versions ant\u00e9rieures sont potentiellement vuln\u00e9rables mais non soutenues par l\u0027\u00e9diteur",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Branche 2.5 de Struts jusqu\u0027\u00e0 la version 2.5.16",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "closed_at": "2018-10-10",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2018-11776",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-11776"
    }
  ],
  "initial_release_date": "2018-08-29T00:00:00",
  "last_revision_date": "2018-10-10T00:00:00",
  "links": [
    {
      "title": "Avis de vuln\u00e9rabilit\u00e9 publi\u00e9 par le CERT-FR",
      "url": "https://cert.ssi.gouv.fr/avis/CERTFR-2018-AVI-405/"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de la fondation Apache sur la vuln\u00e9rabilit\u00e9",
      "url": "https://cwiki.apache.org/confluence/display/WW/S2-057"
    },
    {
      "title": "Publication de la soci\u00e9t\u00e9 Veloxity relative \u00e0 l\u0027exploitation de la vuln\u00e9rabilit\u00e9 CVE-2018-11776 incluant des marqueurs de compromission",
      "url": "https://www.volexity.com/blog/2018/08/27/active-exploitation-of-new-apache-struts-vulnerability-cve-2018-11776-deploys-cryptocurrency-miner/"
    }
  ],
  "reference": "CERTFR-2018-ALE-010",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2018-08-29T00:00:00.000000"
    },
    {
      "description": "Modification du titre",
      "revision_date": "2018-08-30T00:00:00.000000"
    },
    {
      "description": "Correction d\u0027une erreur dans le titre d\u0027un lien",
      "revision_date": "2018-08-30T00:00:00.000000"
    },
    {
      "description": "Cl\u00f4ture de l\u0027alerte.",
      "revision_date": "2018-10-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Le 22 ao\u00fbt 2018, la fondation Apache a publi\u00e9 un correctif de s\u00e9curit\u00e9\npour le framework d\u0027application web Struts. Celui-ci concerne la\nvuln\u00e9rabilit\u00e9 CVE-2018-11776 permettant d\u0027ex\u00e9cuter du code \u00e0 distance\nsans authentification. L\u0027exploitation ne n\u00e9cessite pas l\u0027installation de\nmodules compl\u00e9mentaires \u00e0 Struts.\n\nLe 23 et le 24 ao\u00fbt plusieurs codes d\u0027exploitation fonctionnels sont\napparus en source ouverte. La soci\u00e9t\u00e9 Volexity a peu apr\u00e8s constat\u00e9 des\ntentatives d\u0027exploitation en masse de ces vuln\u00e9rabilit\u00e9s. En cas de\nr\u00e9ussite, un mineur de cryptomonnaie est install\u00e9e par l\u0027attaquant.\n\nDes indicateurs de compromission sont pr\u00e9sents dans la publication de la\nsoci\u00e9t\u00e9 Veloxity.\n\n\u00a0\n",
  "title": "Vuln\u00e9rabilit\u00e9 activement exploit\u00e9e dans le framework STRUTS 2",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 STRUTS S2-057 du 22 ao\u00fbt 2018",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Struts versions 2.5.x ant\u00e9rieures \u00e0 2.5.10.1",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Struts versions 2.3.x ant\u00e9rieures \u00e0 2.3.32",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "closed_at": "2017-05-10",
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 dans Struts permet une ex\u00e9cution de code arbitraire \u00e0\ndistance.  \nLe 06 mars 2017, Apache a publi\u00e9 le bulletin de s\u00e9curit\u00e9 S2-045 (cf.\nsection Documentation) afin de fournir un correctif de s\u00e9curit\u00e9.  \nDepuis, cette vuln\u00e9rabilit\u00e9 est activement exploit\u00e9e.  \nAu vu de l\u0027impact et du faible niveau de technicit\u00e9 n\u00e9cessaire \u00e0\nl\u0027exploitation de cette vuln\u00e9rabilit\u00e9, le CERT-FR recommande donc le\nd\u00e9ploiement du correctif dans les plus brefs d\u00e9lais.  \nSi les applications vuln\u00e9rables contiennent des donn\u00e9es sensibles, il\nest \u00e9galement fortement conseill\u00e9 de les d\u00e9sactiver tant que la mise \u00e0\njour n\u0027a pas \u00e9t\u00e9 appliqu\u00e9e.  \nLe 20 mars 2017, le CERT-FR a publi\u00e9 un article concernant cette\nvuln\u00e9rabilit\u00e9 dans son bulletin d\u0027actualit\u00e9 hebdomadaire (cf. section\nDocumentation).\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2017-5638",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-5638"
    }
  ],
  "initial_release_date": "2017-03-10T00:00:00",
  "last_revision_date": "2017-05-10T00:00:00",
  "links": [
    {
      "title": "Bulletin d\u0027actualit\u00e9 CERT-FR CERTFR-2017-ACT-012",
      "url": "http://www.cert.ssi.gouv.fr/site/CERTFR-2017-ACT-012/index.html"
    },
    {
      "title": "Billet Trend Micro",
      "url": "http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/"
    },
    {
      "title": "Avis CERT-FR CERTFR-2017-AVI-071",
      "url": "http://www.cert.ssi.gouv.fr/site/CERTFR-2017-AVI-071/index.html"
    }
  ],
  "reference": "CERTFR-2017-ALE-004",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2017-03-10T00:00:00.000000"
    },
    {
      "description": "passage du titre au singulier.",
      "revision_date": "2017-03-13T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence au bulletin d\u0027actualit\u00e9 CERT-FR CERTFR-2017-ACT-012.",
      "revision_date": "2017-03-22T00:00:00.000000"
    },
    {
      "description": "cl\u00f4ture de l\u0027alerte.",
      "revision_date": "2017-05-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans \u003cspan class=\"textit\"\u003eApache\nStruts\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Struts",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache S2-045 du 10 mars 2017",
      "url": "https://cwiki.apache.org/confluence/display/WW/S2-045"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Struts versions 2.3.16.1 et ant\u00e9rieures",
      "product": {
        "name": "Struts",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "closed_at": "2014-04-29",
  "content": "## Description\n\nCette vuln\u00e9rabilit\u00e9 est issue d\u0027une m\u00e9thode de contournement de la\nsolution propos\u00e9e par Apache Struts afin de rem\u00e9dier \u00e0 la vuln\u00e9rabilit\u00e9\nCVE-2014-0094 d\u00e9crite dans l\u0027annonce de s\u00e9curit\u00e9 S2-020 du 07 mars 2014\n(cf. section Documentation).\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2014-0094",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-0094"
    }
  ],
  "initial_release_date": "2014-04-25T00:00:00",
  "last_revision_date": "2014-04-29T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Apache S2-020 du 07 mars 2014",
      "url": "http://struts.apache.org/release/2.3.x/docs/s2-020.html"
    },
    {
      "title": "Avis du CERT-FR",
      "url": "http://cert.ssi.gouv.fr/site/CERTFR-2014-AVI-111/"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Apache S2-021 du 24 avril 2014",
      "url": "http://struts.apache.org/release/2.3.x/docs/s2-021.html"
    }
  ],
  "reference": "CERTFR-2014-ALE-004",
  "revisions": [
    {
      "description": "version initiale ;",
      "revision_date": "2014-04-25T00:00:00.000000"
    },
    {
      "description": "fermeture de l\u0027alerte, suite \u00e0 la diffusion du correctif par l\u0027\u00e9diteur.",
      "revision_date": "2014-04-29T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans \u003cspan class=\"textit\"\u003eApache\nStruts\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Struts",
  "vendor_advisories": [
    {
      "published_at": "2014-04-24",
      "title": "Bulletin de s\u00e9curit\u00e9 S2-021 Apache Struts",
      "url": "None"
    },
    {
      "published_at": "2014-04-24",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Struts",
      "url": "http://struts.apache.org/announce.html"
    }
  ]
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T23:53:32.156Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "24874",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/24874"
          },
          {
            "name": "51628",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/51628"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security-tracker.debian.org/tracker/CVE-2011-3923"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3923"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2014/Jul/38"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1026575"
          },
          {
            "name": "72585",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72585"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Struts",
          "vendor": "Apache",
          "versions": [
            {
              "status": "affected",
              "version": "2.3.1.2"
            }
          ]
        }
      ],
      "datePublic": "2012-01-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Other",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-01T13:57:37.000Z",
        "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
        "shortName": "Chrome"
      },
      "references": [
        {
          "name": "24874",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/24874"
        },
        {
          "name": "51628",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/51628"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security-tracker.debian.org/tracker/CVE-2011-3923"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3923"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2014/Jul/38"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.securitytracker.com/id?1026575"
        },
        {
          "name": "72585",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72585"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@google.com",
          "ID": "CVE-2011-3923",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Struts",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2.3.1.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "24874",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/24874"
            },
            {
              "name": "51628",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/51628"
            },
            {
              "name": "https://security-tracker.debian.org/tracker/CVE-2011-3923",
              "refsource": "MISC",
              "url": "https://security-tracker.debian.org/tracker/CVE-2011-3923"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3923",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3923"
            },
            {
              "name": "http://seclists.org/fulldisclosure/2014/Jul/38",
              "refsource": "MISC",
              "url": "http://seclists.org/fulldisclosure/2014/Jul/38"
            },
            {
              "name": "http://www.securitytracker.com/id?1026575",
              "refsource": "MISC",
              "url": "http://www.securitytracker.com/id?1026575"
            },
            {
              "name": "72585",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72585"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
    "assignerShortName": "Chrome",
    "cveId": "CVE-2011-3923",
    "datePublished": "2019-11-01T13:57:37.000Z",
    "dateReserved": "2011-10-01T00:00:00.000Z",
    "dateUpdated": "2024-08-06T23:53:32.156Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}