CVE-2019-0233

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-281

Affected software

No affected versions have been published.

Timeline

Published
Sep 14, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-02346.1A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize CVE-2019-02358.8Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.CVE-2019-02386.1SAP Commerce (previously known as SAP Hybris Commerce), before version 6.7, does not sufficiently encode user-controlled inputs, resulting iCVE-2019-02407.5SAP Business Objects Mobile for Android (before 6.3.5) application allows an attacker to provide malicious input in the form of a SAP BI linCVE-2019-02417.5SAP Work and Inventory Manager (Agentry_SDK , before 7.0, 7.1) allows an attacker to prevent legitimate users from accessing a service, eithCVE-2019-02438.8Under some circumstances, masterdata maintenance in SAP BW/4HANA (fixed in DW4CORE version 1.0 (SP08)) does not perform necessary authorizatCVE-2019-02445.4SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-contrCVE-2019-02455.4SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-contrCVE-2019-02469.8SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity.CVE-2019-02479.8SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application. An attacker could theCVE-2019-02485.9Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attackerCVE-2019-02497.5Under certain conditions SAP Landscape Management (VCM 3.0) allows an attacker to access information which would otherwise be restricted.
CVE-2019-0233: High severity, CVSS 7.5 | Vulnix