Apache Struts: Possible Remote Code Execution

[engine]

Time to update to Apache Struts V 2.3.32 or 2.5.10.1 to avoid a remote code execution attack.

Solution

If you are using Jakarta based file upload Multipart parser, upgrade to Apache Struts version 2.3.32 or 2.5.10.1. You can also switch to a different implementation of the Multipart parser. Apache Struts: Possible Remote Code Execution [cwiki.apache.org]

[phranque]

discussion of a specific site's solutions/workarounds in this thread in the Apache Web Server forum:
latest Apache struts security issue [webmasterworld.com]