Detections
Analytics
MySQL Enterprise Monitor < 2.3.14 Apache Struts Multiple Vulnerabilities
critical Nessus Plugin ID 83292
Language:
Synopsis
A web application running on the remote host is affected by multiple vulnerabilities.Description
According to its self-reported version, the MySQL Enterprise Monitor running on the remote host is affected by the multiple vulnerabilities in the bundled version of Apache Struts :- Input validation errors exist that allows the execution of arbitrary Object-Graph Navigation Language (OGNL) expressions via specially crafted parameters to the DefaultActionMapper. (CVE-2013-2251)
- Multiple unspecified vulnerabilities exist related to dynamic method invocation being enabled by default.
(CVE-2013-4316)
Solution
Upgrade to MySQL Enterprise Monitor 2.3.14 or later.See Also
http://www.nessus.org/u?17c46362
http://www.nessus.org/u?ac29c174
Plugin Details
Severity: Critical
ID: 83292
File Name: mysql_enterprise_monitor_2_3_14.nasl
Version: 1.11
Type: remote
Family: CGI abuses
Published: 5/8/2015
Updated: 4/25/2023
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: High
Score: 8.4
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.3
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2013-4316
Vulnerability Information
CPE: cpe:/a:mysql:enterprise_monitor, cpe:/a:apache:struts
Required KB Items: installed_sw/MySQL Enterprise Monitor
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 9/9/2013
Vulnerability Publication Date: 7/16/2013
CISA Known Exploited Vulnerability Due Dates: 4/15/2022
Exploitable With
CANVAS (CANVAS)
Core Impact
Metasploit (Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution)
Elliot (Apache-Struts DefaultActionMapper < 2.3.15.1 RCE Linux)
Reference Information
CVE: CVE-2013-2251, CVE-2013-4316