Vulnerability CVE-2019-0233 - CERT Civis.Net

Vulnerability Name:

CVE-2019-0233 (CCN-186699)

Assigned:

2018-11-14

Published:

2020-08-11

Updated:

2022-04-18

Summary:

An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.

CVSS v3 Severity:

7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

5.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
5.2 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

5.4 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2019-0233

Source: CCN
Type: JVN#50890770
Apache Struts 2 vulnerable to denial-of-service (DoS)

Source: CCN
Type: Apache Struts 2 Documentation S2-060
Access permission override causing a Denial of Service when performing a file upload

Source: MISC
Type: Vendor Advisory
https://cwiki.apache.org/confluence/display/ww/s2-060

Source: XF
Type: UNKNOWN
apache-struts-cve20190233-dos(186699)

Source: MISC
Type: Permissions Required, Third Party Advisory
https://launchpad.support.sap.com/#/notes/2982840

Source: CCN
Type: IBM Security Bulletin 6324787 (Sterling File Gateway)
Multiple Security Vulnerabilities in Apache Struts Affect IBM Sterling File Gateway (CVE-2019-0233, CVE-2019-0230)

Source: CCN
Type: IBM Security Bulletin 6336355 (Tivoli Netcool OMNIbus)
Multiple vulnerabilities in Apache Struts affect Tivoli Netcool/OMNIbus WebGUI (CVE-2019-0233, CVE-2019-0230)

Source: CCN
Type: IBM Security Bulletin 6347964 (Tivoli Application Dependency Discovery Manager)
Vulnerabilities in Apache Struts affect IBM Tivoli Application Dependency Discovery Manager.

Source: CCN
Type: IBM Security Bulletin 6356619 (Content Collector)
Apache Struts (Publicly disclosed vulnerability) affects Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections

Source: CCN
Type: IBM Security Bulletin 6356621 (Content Collector)
Apache Struts (Publicly disclosed vulnerability) affects Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections

Source: CCN
Type: IBM Security Bulletin 6359443 (Content Collector)
Apache Struts (Publicly disclosed vulnerability) affects Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections

Source: CCN
Type: IBM Security Bulletin 6359445 (Content Collector)
Apache Struts (Publicly disclosed vulnerability) affects Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections

Source: CCN
Type: IBM Security Bulletin 6565845 (Sterling Order Management)
IBM Sterling Order Management Apache Struts vulnerablity

Source: CCN
Type: IBM Security Bulletin 6620351 (Call Center for Commerce)
IBM Call Center and Apache Struts Struts upgrade strategy (various CVEs, see below)

Source: CCN
Type: IBM Security Bulletin 6620355 (Sterling Order Management)
IBM Sterling Order Management Apache Struts upgrade strategy (various CVEs, see below)

Source: MISC
Type: Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html

Source: MISC
Type: Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html

Source: MISC
Type: Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html

Vulnerable Configuration:

Configuration 1:

cpe:/a:apache:struts:*:*:*:*:*:*:*:* (Version >= 2.0.0 and <= 2.5.20)

Configuration 2:

cpe:/a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:financial_services_data_integration_hub:8.0.3:*:*:*:*:*:*:*

OR cpe:/a:oracle:financial_services_data_integration_hub:8.0.6:*:*:*:*:*:*:*

OR cpe:/a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* (Version <= 8.0.23)

Configuration CCN 1:

cpe:/a:apache:struts:2.0.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.5:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.6:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.9:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.10:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.11:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.11.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.11.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.0:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.12:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.13:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.14:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.4:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.7:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.0:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.4:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.5:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.6:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.8:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.8.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.2.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.2.1.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.2.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.14.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.13:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.14:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.15:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.15.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.2.3.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.8:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.7:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.4.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.4:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.1.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.1.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.12:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.14.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.14.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.15.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.16:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.15.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.16.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.16.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.16.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.20:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.24:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.24.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.28:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.30:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.5:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.10:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.11:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.12:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.5:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.8:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.10.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.13:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.14:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.14.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.16:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.20.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.20.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.24.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.28.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.29:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.31:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.32:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.33:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.34:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.6:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.9:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.10:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.11:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.14.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.15:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.17:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.19:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.20.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.21:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.22:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.23:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.24.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.25:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.26:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.27:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.16:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.4:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.6:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.7:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.9:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.17:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.18:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.19:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.20:*:*:*:*:*:*:*

AND

cpe:/a:ibm:tivoli_netcool/omnibus:8.1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:sterling_file_gateway:2.2.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_application_dependency_discovery_manager:7.3.0.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:content_collector:4.0.1.10:*:*:*:*:*:*:*

OR cpe:/a:ibm:sterling_file_gateway:6.0.3.2:*:*:*:*:*:*:*

Denotes that component is vulnerable