Vulnerability in Apache Struts
CVE-2018-11776
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 1.000 (100.0th percentile), scored .
Very high probability of exploitation in the next 30 days — among the top 0.1% most-likely-to-be-exploited CVEs. 100th percentile — 100.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
The 30-day trend appears once there are two daily scores.
Affected products
- Apache Struts
- Apache Software Foundation Struts — versions 2.5 to 2.5.16, 2.3 to 2.3.34
- NetApp Active Iq Unified Manager
- NetApp Oncommand Insight
- NetApp Oncommand Workflow Automation
- NetApp Snapcenter
- Oracle Communications Policy Management
- Oracle Enterprise Manager Base Platform — versions 13.3.0.0, 13.4.0.0
- Oracle MySQL Enterprise Monitor
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply updates per vendor instructions.
Public proof-of-concept exploits
References
- www.securitytracker.com/id/1041888 (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
- www.exploit-db.com/exploits/45367/ (Exploit, VDB Entry, Third Party Advisory, exploit)
- www.exploit-db.com/exploits/45262/ (Exploit, VDB Entry, Third Party Advisory, exploit)
- www.securityfocus.com/bid/105125 (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
- www.securitytracker.com/id/1041547 (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
- www.exploit-db.com/exploits/45260/ (Exploit, VDB Entry, Third Party Advisory, exploit)
- lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3c… (mailing-list, Mailing List)
- www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html (Patch, Third Party Advisory)
- www.oracle.com/security-alerts/cpujul2020.html (Third Party Advisory)
- www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2018-11776?
- CVE-2018-11776 is a high-severity vulnerability in Apache Struts. CVSS score: 8.1/10. Published 2018-08-22.
- How severe is CVE-2018-11776?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2018-11776 known to be exploited?
- Yes. CVE-2018-11776 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating it is being actively exploited. 203 public proof-of-concept repositories are indexed.