View all newsletters
Receive our newsletter - data, insights and analysis delivered to you

Cisco patches up Apache Struts 2 exploit

However, there is no update for Cisco Business Edition 3000.


Cisco has urged developers to add software updates to multiple unified contact centre business products that include Apache Struts 2 software.

The networking firm issued a patch for the four-year-old vulnerability, which would have allowed a malicious hacker to bypass the ‘#’-usage protection built into the ParametersInterceptor.

"An attacker could exploit this vulnerability by sending crafted requests that contain OGNL expressions to an affected system. An exploit could allow the attacker to execute arbitrary code on the targeted system," Cisco said in a statement.

"This vulnerability has been confirmed to allow remote code execution with the privileges of the Administrator user for the Cisco Unified CCE. Exploitation on Cisco ISE, Cisco MXE 3500, and Cisco Business Edition 3000 Series is theoretically possible but could not be reproduced," it added.

Cisco has released free software updates that address this vulnerability for all affected products except Cisco Business Edition 3000 Series.

Users using Cisco Business Edition 3000 Series should contact their Cisco representative for available options, Cisco said

Content from our partners
European Technology Leadership: Deutsche Bank CTO Gordon Mackechnie
Print’s role in driving the environmental agenda
What finance leaders get wrong about digital transformation

Websites in our network
NEWSLETTER Sign up Tick the boxes of the newsletters you would like to receive. Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
I consent to New Statesman Media Group collecting my details provided via this form in accordance with the Privacy Policy