{
  "document": {
    "acknowledgments": [
      {
        "summary": "On November 5th, 2018, the Apache Software Foundation released a security announcement at the following link: Immediately upgrade commons-fileupload to version 1.3.3 when running Struts 2.3.36 or prior [\"https://www.mail-archive.com/announcements@struts.apache.org/msg00093.html\"]"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "notes": [
      {
        "category": "summary",
        "text": "On November 5, 2018, the Apache Struts Team released a security announcement urging an upgrade of the Commons FileUpload library to version 1.3.3 on systems using Struts 2.3.36 or earlier releases. Systems using earlier versions of this library may be exposed to attacks that could allow execution of arbitrary code or modifications of files on the system. The issue is caused by a previously reported vulnerability of the Apache Commons FileUpload library, assigned to CVE-2016-1000031.\r\n\r\nThe vulnerability is due to insufficient validation of user-supplied input by the affected software. An attacker could exploit this vulnerability by submitting crafted data to an affected system. A successful exploit could allow the attacker to execute arbitrary code or manipulate files on the targeted system.\r\n\r\nThis advisory is available at the following link:\r\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-struts-commons-fileupload [\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-struts-commons-fileupload\"]",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "Cisco investigated its product line to determine which products and services may be affected by this vulnerability.\r\n\r\nThe Vulnerable Products [\"#vp\"] section of this advisory includes Cisco bug IDs for each affected product or service. The bugs are accessible through the Cisco Bug Search Tool [\"https://bst.cloudapps.cisco.com/bugsearch/bug/BUGID\"] and contain additional platform-specific information, including workarounds (if available) and fixed software releases.\r\n\r\nAny product or service not listed in the \u201cVulnerable Products\u201d section of this advisory is to be considered not vulnerable.",
        "title": "Affected Products"
      },
      {
        "category": "general",
        "text": "The following table lists Cisco products and services that are affected by the vulnerability that is described in this advisory. The software availability dates in the Fixed Release Availability column are estimates, and actual software availability may differ from the dates provided in the following table.\r\n                                Product              Cisco Bug ID              Fixed Release Availability                                  Collaboration and Social Media                                  Cisco SocialMiner              CSCvn22343 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22343\"]              Patch file available for 11.5/11.6 by Dec 2018\r\n12.0.1 (Jan 2019)                                  Cisco Webex Meetings Server              CSCvn18895 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18895\"]              2.8MR3 Security Patch 1 (Dec 2018)\r\n3.0MR2 Security Patch 2 (Dec 2018)                                  Endpoint Clients and Client Software                                  Cisco Webex Management - SuperAdmin Control Panel              CSCvn18901 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18901\"]              T33.7.2 (Dec 2018)                                  Network and Content Security Devices                                  Cisco Identity Services Engine (ISE)              CSCvn17524 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn17524\"]              Hot patch available for 2.1 Patch 7/2.3 Patch 5\r\n2.2 Patch 12 (Nov 2018)\r\n2.3 Patch 6 (Feb 2019)\r\n2.4 Patch 5 (Nov 2018)\r\n2.5 (Dec 2018)                                  Cisco Secure Access Control System (ACS)              CSCvn18934 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18934\"]              No fix planned 1                                  Network Management and Provisioning                                  Cisco Evolved Programmable Network Manager              CSCvn44132 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn44132\"]              2.2.1.2 (Dec 2018)                                  Cisco Prime Collaboration Provisioning              CSCvn18919 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18919\"]              12.6 (Nov 2018)                                  Cisco Prime Infrastructure              CSCvn18917 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18917\"]              3.3.1 Update 04 (Feb 2019)\r\n3.4.1 Update 03 (Mar 2019)\r\n3.5 (Dec 2018)                                  Cisco Prime License Manager              CSCvn18924 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18924\"]              Patch file available for 10.5.2/11.5.1 by Dec 2018                                  Cisco Prime Network Registrar IP Address Manager (IPAM)              CSCvn18913 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18913\"]              No fix planned                                  Cisco Prime Network              CSCvn18910 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18910\"]              Patch file available for 5.1 by Dec 2018\r\n5.2 (May 2019)                                  Cisco Prime Service Catalog              CSCvn22307 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22307\"]              12.1 v7 Patch (Dec 2018)                                  Routing and Switching - Enterprise and Service Provider                                  Cisco IOx Fog Director              CSCvn19758 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn19758\"]              1.7.1 (Jan 2019)\r\n1.8 (Feb 2019)                                  Cisco IoT Field Network Director (formerly Cisco Connected Grid Network Management System)              CSCvn20600 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn20600\"]              4.3.2 (Dec 2018)                                  Voice and Unified Communications Devices                                  Cisco Emergency Responder              CSCvn18956 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18956\"]              Patch file available for 11.5.1/12.0.1 by Dec 2018\r\n12.5.1 (Jan 2019)                                  Cisco Enterprise Chat and Email              CSCvn18957 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18957\"]              11.6 ES6 (Jan 2019)\r\n12.0.1 (Jan 2019)                                  Cisco Finesse              CSCvn22344 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22344\"]              Patch file available for 11.6 by Dec 2018\r\n12.0.1 (Jan 2019)                                  Cisco Hosted Collaboration Mediation Fulfillment              CSCvn18961 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18961\"]              11.5(4) (Available)                                  Cisco Hosted Collaboration Solution for Contact Center              CSCvn18962 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18962\"]              12.0.1 (Jan 2019)                                  Cisco MediaSense              CSCvn22346 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22346\"]              No fix planned                                  Cisco Unified Communications Manager IM \u0026 Presence Service (formerly CUPS)              CSCvn18959 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18959\"]              Patch file available for 10.5.2/11.5.1/12.0.1 by Dec 2018\r\n12.5.1 (Jan 2019)                                  Cisco Unified Communications Manager              CSCvn18952 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18952\"]              Patch file available for 10.5.2/11.5.1/12.0.1 by Dec 2018\r\n12.5.1 (Jan 2019)                                  Cisco Unified Contact Center Enterprise              CSCvn18888 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18888\"]              12.0.1 (Jan 2019)                                  Cisco Unified Contact Center Express              CSCvn18955 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18955\"]              Patch file available for 11.5/11.6 by Dec 2018\r\n12.0.1 (Jan 2019)                                  Cisco Unified E-Mail Interaction Manager              CSCvn18958 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18958\"]              No fix planned                                  Cisco Unified Intelligence Center              CSCvn18887 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18887\"]              Patch file available for 11.5/11.6 by Dec 2018\r\n12.0.1 (Jan 2019)                                  Cisco Unified Intelligent Contact Management Enterprise              CSCvn18888 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18888\"]              12.0.1 (Jan 2019)                                  Cisco Unified Web Interaction Manager              CSCvn18958 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18958\"]              No fix planned                                  Cisco Unity Connection              CSCvn18954 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18954\"]              Patch file available for 10.5.2/11.5.1/12.0.1 by Dec 2018\r\n12.5.1 (Jan 2019)                                  Cisco Virtualized Voice Browser              CSCvn18963 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18963\"]              Patch file available for 11.5/11.6 by Dec 2018\r\n12.0.1 (Jan 2019)                                  Video, Streaming, TelePresence, and Transcoding Devices                                  Cisco Video Distribution Suite for Internet Streaming (VDS-IS)              CSCvn18928 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18928\"]              Patch file available by Dec 2018                                  Wireless                                  Cisco Mobility Services Engine              CSCvn22305 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22305\"]              Patch file available by Dec 2018                                  Cisco Universal Small Cell RAN Management System (USC RMS)              CSCvn18939 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18939\"]              No fix planned                                  Cisco Cloud Hosted Services                                  Cisco Prime Network Change and Configuration Management              CSCvn19865 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn19865\"]              3.6.1 (Dec 2018)\r\n3.7 (Mar 2019)                                  Cisco Smart Connected Spaces              CSCvn22310 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22310\"]              Patch file available by Dec 2018                                  Cisco Smart Net Total Care - Contracts Information System Process Controller              CSCvn18884 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18884\"]              4.3.6 (Dec 2018)                                  Cisco Webex Centers - Meeting Center, Training Center, Event Center, Support Center\r\n              CSCvn24113 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn24113\"]              T33.7.2 (Dec 2018)\r\nT32.20.2 (Dec 2018)                                  Cisco Webex Meetings              CSCvn18908 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18908\"]              Cisco will update affected systems in Dec 2018\r\n1 Cisco Secure Access Control System (ACS) has reached the End of Software Maintenance (EoSWM) milestone [\"https://www.cisco.com/c/en/us/products/collateral/security/secure-access-control-system/eos-eol-c51-738197.html\"]. Only authenticated attackers with access to the Cisco ACS admin console could exploit this vulnerability. An administrator could also limit access to the Cisco ACS admin panel from trusted hosts in their environment.",
        "title": "Vulnerable Products"
      },
      {
        "category": "general",
        "text": "Only products listed in the Vulnerable Products [\"#vp\"] section of this advisory are known to be affected by this vulnerability.\r\n\r\nCisco has confirmed that this vulnerability does not affect the following products and services:\r\n  Network Application, Service, and Acceleration\r\n\r\nCisco Data Center Network Manager\r\nNetwork and Content Security Devices\r\n\r\nCisco Firepower Management Center\r\nCisco Stealthwatch Endpoint Concentrator\r\nCisco Stealthwatch FlowCollector NetFlow\r\nCisco Stealthwatch FlowCollector sFlow\r\nCisco Stealthwatch FlowSensor\r\nCisco Stealthwatch Management Console (SMC)\r\nCisco Stealthwatch UDP Director\r\nNetwork Management and Provisioning\r\n\r\nCisco Prime Access Registrar\r\nCisco Prime Central for Service Providers\r\nCisco Prime Collaboration Assurance\r\nCisco Prime Collaboration Deployment\r\nCisco Prime LAN Management Solution\r\nCisco Prime Provisioning\r\nCisco Security Manager\r\nRouting and Switching - Enterprise and Service Provider\r\n\r\nCisco Broadband Access Center for Telco and Wireless\r\nUnified Computing\r\n\r\nCisco HyperFlex System\r\nVoice and Unified Communications Devices\r\n\r\nCisco Unified Customer Voice Portal\r\nCisco Unified SIP Proxy Software\r\nCisco Unified Survivable Remote Site Telephony Manager\r\nCisco Unity Express\r\nVideo, Streaming, TelePresence, and Transcoding Devices\r\n\r\nCisco StadiumVision Director\r\nCisco TelePresence Management Suite\r\nCisco Cloud Hosted Services\r\n\r\nCisco Business Video Services Automation Software\r\nCisco Cloud Web Security\r\nCisco Common Services Platform Collector\r\nCisco Network Device Security Assessment Service\r\nCisco Network Performance Analysis\r\nCisco Smart Net Total Care - On-Premises\r\nCisco Smart Net Total Care\r\nCisco Unified Service Delivery Platform\r\nCisco Webex Network-Based Recording (NBR) Management",
        "title": "Products Confirmed Not Vulnerable"
      },
      {
        "category": "general",
        "text": "Any workarounds for a specific Cisco product or service will be documented in product-specific or service-specific Cisco bugs, which are identified in the Vulnerable Products [\"#vp\"] section of this advisory.",
        "title": "Workarounds"
      },
      {
        "category": "general",
        "text": "For information about fixed software releases, consult the Cisco bugs identified in the Vulnerable Products [\"#vp\"] section of this advisory. Questions concerning the Webex environment may be directed to the Cisco Technical Assistance Center (TAC).\r\n\r\nWhen considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories and Alerts page [\"https://www.cisco.com/go/psirt\"], to determine exposure and a complete upgrade solution.\r\n\r\nIn all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco TAC or their contracted maintenance providers.",
        "title": "Fixed Software"
      },
      {
        "category": "general",
        "text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.",
        "title": "Vulnerability Policy"
      },
      {
        "category": "general",
        "text": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any malicious use of the vulnerability that is described in this advisory.",
        "title": "Exploitation and Public Announcements"
      },
      {
        "category": "general",
        "text": "On November 5th, 2018, the Apache Software Foundation released a security announcement at the following link: Immediately upgrade commons-fileupload to version 1.3.3 when running Struts 2.3.36 or prior [\"https://www.mail-archive.com/announcements@struts.apache.org/msg00093.html\"]",
        "title": "Source"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\r\n\r\nA standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.",
        "title": "Legal Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "Emergency Support:\r\n+1 877 228 7302 (toll-free within North America)\r\n+1 408 525 6532 (International direct-dial)\r\nNon-emergency Support:\r\nEmail: psirt@cisco.com\r\nSupport requests that are received via e-mail are typically acknowledged within 48 hours.",
      "issuing_authority": "Cisco product security incident response is the responsibility of the Cisco Product Security Incident Response Team (PSIRT). The Cisco PSIRT is a dedicated, global team that manages the receipt, investigation, and public reporting of security vulnerability information that is related to Cisco products and networks. The on-call Cisco PSIRT works 24x7 with Cisco customers, independent security researchers, consultants, industry organizations, and other vendors to identify possible security issues with Cisco products and networks.\r\nMore information can be found in Cisco Security Vulnerability Policy available at https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html",
      "name": "Cisco",
      "namespace": "https://wwww.cisco.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Apache Struts Commons FileUpload Library Remote Code Execution Vulnerability Affecting Cisco Products: November 2018",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-struts-commons-fileupload"
      },
      {
        "category": "external",
        "summary": "Cisco Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-struts-commons-fileupload",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-struts-commons-fileupload"
      },
      {
        "category": "external",
        "summary": "Cisco Bug Search Tool",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/BUGID"
      },
      {
        "category": "external",
        "summary": "CSCvn22343",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22343"
      },
      {
        "category": "external",
        "summary": "CSCvn18895",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18895"
      },
      {
        "category": "external",
        "summary": "CSCvn18901",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18901"
      },
      {
        "category": "external",
        "summary": "CSCvn17524",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn17524"
      },
      {
        "category": "external",
        "summary": "CSCvn18934",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18934"
      },
      {
        "category": "external",
        "summary": "CSCvn44132",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn44132"
      },
      {
        "category": "external",
        "summary": "CSCvn18919",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18919"
      },
      {
        "category": "external",
        "summary": "CSCvn18917",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18917"
      },
      {
        "category": "external",
        "summary": "CSCvn18924",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18924"
      },
      {
        "category": "external",
        "summary": "CSCvn18913",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18913"
      },
      {
        "category": "external",
        "summary": "CSCvn18910",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18910"
      },
      {
        "category": "external",
        "summary": "CSCvn22307",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22307"
      },
      {
        "category": "external",
        "summary": "CSCvn19758",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn19758"
      },
      {
        "category": "external",
        "summary": "CSCvn20600",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn20600"
      },
      {
        "category": "external",
        "summary": "CSCvn18956",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18956"
      },
      {
        "category": "external",
        "summary": "CSCvn18957",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18957"
      },
      {
        "category": "external",
        "summary": "CSCvn22344",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22344"
      },
      {
        "category": "external",
        "summary": "CSCvn18961",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18961"
      },
      {
        "category": "external",
        "summary": "CSCvn18962",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18962"
      },
      {
        "category": "external",
        "summary": "CSCvn22346",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22346"
      },
      {
        "category": "external",
        "summary": "CSCvn18959",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18959"
      },
      {
        "category": "external",
        "summary": "CSCvn18952",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18952"
      },
      {
        "category": "external",
        "summary": "CSCvn18888",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18888"
      },
      {
        "category": "external",
        "summary": "CSCvn18955",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18955"
      },
      {
        "category": "external",
        "summary": "CSCvn18958",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18958"
      },
      {
        "category": "external",
        "summary": "CSCvn18887",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18887"
      },
      {
        "category": "external",
        "summary": "CSCvn18888",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18888"
      },
      {
        "category": "external",
        "summary": "CSCvn18958",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18958"
      },
      {
        "category": "external",
        "summary": "CSCvn18954",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18954"
      },
      {
        "category": "external",
        "summary": "CSCvn18963",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18963"
      },
      {
        "category": "external",
        "summary": "CSCvn18928",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18928"
      },
      {
        "category": "external",
        "summary": "CSCvn22305",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22305"
      },
      {
        "category": "external",
        "summary": "CSCvn18939",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18939"
      },
      {
        "category": "external",
        "summary": "CSCvn19865",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn19865"
      },
      {
        "category": "external",
        "summary": "CSCvn22310",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22310"
      },
      {
        "category": "external",
        "summary": "CSCvn18884",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18884"
      },
      {
        "category": "external",
        "summary": "CSCvn24113",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn24113"
      },
      {
        "category": "external",
        "summary": "CSCvn18908",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18908"
      },
      {
        "category": "external",
        "summary": "End of Software Maintenance (EoSWM) milestone",
        "url": "https://www.cisco.com/c/en/us/products/collateral/security/secure-access-control-system/eos-eol-c51-738197.html"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisories and Alerts page",
        "url": "https://www.cisco.com/go/psirt"
      },
      {
        "category": "external",
        "summary": "Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "Immediately upgrade commons-fileupload to version 1.3.3 when running Struts 2.3.36 or prior",
        "url": "https://www.mail-archive.com/announcements@struts.apache.org/msg00093.html"
      }
    ],
    "title": "Apache Struts Commons FileUpload Library Remote Code Execution Vulnerability Affecting Cisco Products: November 2018",
    "tracking": {
      "current_release_date": "2019-02-07T14:49:00+00:00",
      "generator": {
        "date": "2022-10-22T03:01:20+00:00",
        "engine": {
          "name": "TVCE"
        }
      },
      "id": "cisco-sa-20181107-struts-commons-fileupload",
      "initial_release_date": "2018-11-07T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2018-11-07T21:47:08+00:00",
          "number": "1.0.0",
          "summary": "Initial public release."
        },
        {
          "date": "2018-11-08T21:05:37+00:00",
          "number": "1.1.0",
          "summary": "Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable."
        },
        {
          "date": "2018-11-09T18:57:30+00:00",
          "number": "1.2.0",
          "summary": "Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability."
        },
        {
          "date": "2018-11-12T20:29:14+00:00",
          "number": "1.3.0",
          "summary": "Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability."
        },
        {
          "date": "2018-11-13T20:59:30+00:00",
          "number": "1.4.0",
          "summary": "Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability. Indicated that the Cisco TAC is a resource for the Webex environment."
        },
        {
          "date": "2018-11-14T19:42:41+00:00",
          "number": "1.5.0",
          "summary": "Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability."
        },
        {
          "date": "2018-11-15T18:26:20+00:00",
          "number": "1.6.0",
          "summary": "Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability."
        },
        {
          "date": "2018-11-16T19:45:35+00:00",
          "number": "1.7.0",
          "summary": "Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable."
        },
        {
          "date": "2018-11-19T18:53:44+00:00",
          "number": "1.8.0",
          "summary": "Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability."
        },
        {
          "date": "2018-11-20T18:56:12+00:00",
          "number": "1.9.0",
          "summary": "Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability."
        },
        {
          "date": "2018-11-21T19:35:12+00:00",
          "number": "1.10.0",
          "summary": "Updated the list of vulnerable products. Updated information about fixed release availability."
        },
        {
          "date": "2018-11-22T17:43:09+00:00",
          "number": "1.11.0",
          "summary": "Updated information about Cisco Webex Centers exposure. Updated information about fixed release availability."
        },
        {
          "date": "2018-11-26T17:38:47+00:00",
          "number": "1.12.0",
          "summary": "Updated information about fixed release availability."
        },
        {
          "date": "2018-11-28T18:11:29+00:00",
          "number": "1.13.0",
          "summary": "Updated information about fixed release availability."
        },
        {
          "date": "2018-11-30T18:27:04+00:00",
          "number": "1.14.0",
          "summary": "Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability."
        },
        {
          "date": "2018-12-05T16:34:38+00:00",
          "number": "1.15.0",
          "summary": "Updated information about fixed release availability. Removed references to ongoing investigation."
        },
        {
          "date": "2019-01-11T14:52:41+00:00",
          "number": "1.16.0",
          "summary": "Updated information about fixed release availability for Cisco Prime Infrastructure. The fix was not integrated in release 3.3.1 Update 03 but will be integrated in 3.3.1 Update 04."
        },
        {
          "date": "2019-02-07T14:49:51+00:00",
          "number": "1.17.0",
          "summary": "Updated information about fixed release availability for Cisco Prime Infrastructure. The fix was not integrated in release 3.4.1 Update 02 but will be integrated in 3.4.1 Update 03. Corrected a typo referencing January 2018 instead of January 2019 as availability time for some fixed releases."
        }
      ],
      "status": "final",
      "version": "1.17.0"
    }
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2016-1000031",
      "notes": [
        {
          "category": "general",
          "text": "No additional information for this vulneraiblity is currently avaialbe.",
          "title": "No Notes"
        }
      ],
      "release_date": "2018-11-05T12:32:00+00:00",
      "remediations": [
        {
          "category": "none_available",
          "details": "No remediation is available at this time."
        }
      ],
      "title": "Apache Struts Commons FileUpload Library Remote Code Execution Vulnerability Affecting Cisco Products: November 2018"
    }
  ]
}