CVE-2018-11776
HIGH8.1⚠ KEVEPSS 94.4%Apache Struts vulnerable to remote command execution (RCE) due to improper input validation
Published: 10/18/2018Modified: 10/22/2025Added to CISA KEV: 11/3/2021
Description
Apache Struts contains a Remote Code Execution when using results with no namespace and it's upper actions have no or wildcard namespace. The same flaw exists when using a url tag with no value, action set, and it's upper actions have no or wildcard namespace.
Affected packages (1)
- Maven/org.apache.struts:struts2-core>= 2.0.4, < 2.3.35
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H |
References (27)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2018-11776
- PATCHhttps://github.com/apache/struts
- WEBhttp://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.html
- WEBhttps://cwiki.apache.org/confluence/display/WW/S2-057
- WEBhttps://github.com/apache/struts/commit/6e87474f9ad0549f07dd2c37d50a9ccd0977c6e
- WEBhttps://github.com/hook-s3c/CVE-2018-11776-Python-PoC
- WEBhttps://lgtm.com/blog/apache_struts_CVE-2018-11776
- WEBhttps://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3Cannounce.apache.org%3E
- WEBhttps://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E
- WEBhttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0012
- WEBhttps://security.netapp.com/advisory/ntap-20180822-0001
- WEBhttps://security.netapp.com/advisory/ntap-20181018-0002
- WEBhttps://web.archive.org/web/20180822160726/http://www.securityfocus.com/bid/105125
- WEBhttps://web.archive.org/web/20200807025819/http://www.securitytracker.com/id/1041888
- WEBhttps://web.archive.org/web/20201208145803/https://securitytracker.com/id/1041547
- WEBhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-11776
- WEBhttps://www.exploit-db.com/exploits/45260
- WEBhttps://www.exploit-db.com/exploits/45262
- WEBhttps://www.exploit-db.com/exploits/45367
- WEBhttps://www.oracle.com/security-alerts/cpujul2020.html
- WEBhttps://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- WEBhttp://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txt
- WEBhttp://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787.html
- WEBhttp://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- WEBhttp://www.securityfocus.com/bid/105125
- WEBhttp://www.securitytracker.com/id/1041547
- WEBhttp://www.securitytracker.com/id/1041888