eWeek: Equifax Breach Potentially Triggered by Apache Struts Vulnerability

eWeek: Equifax Breach Potentially Triggered by Apache Struts Vulnerability. “In recent months there have been multiple vulnerabilities that have been patched in the Apache Struts framework. On Sept. 5, the Struts project issued an update for three software vulnerabilities, only one of which was rated as being critical. The critical vulnerability was identified by the Struts project as CVE-2017-9805 and is a possible Remote Code Execution (RCE) attack vulnerability. By its’ own admission, Equifax was breached in mid-May, months before CVE-2017-9805 was publicly disclosed and patched, making it somewhat unlikely that was the vulnerability used by attacker. Another more likely possibility is that attackers made use of a flaw that the Struts project fixed in March identified as CVE-2017-5638, which is also a remote code execution vulnerability.” I’m concerned that if it was indeed a Struts vulnerability, we’re going to be seeing additional breach disclosures from other parties.