Untitled attachment

Notices where this attachment appears

1. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 18-Jan-2024 01:23:28 JST Kevin Beaumont

   in reply to

   We have the first vendor product actually vulnerable to that Apache Struts vuln from December 2023 - CVE-2023-50164.

   Product: Trackplus Allegra
   Tailored POC: https://srcincite.io/pocs/src-2024-0001.py.txt
   Advisory: https://srcincite.io/advisories/src-2024-0001/

   Complete with ../.. directory traversal too.

   Disclosure Timeline:

   2023-11-08 – Vulnerability reported to security@struts.apache.org

   2023-12-21 – Silently patched by the vendor