Vulnerability in Apache Struts
CVE-2018-11776
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
EPSS: 1.000 (100.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Struts
- Apache Software Foundation Struts — versions 2.5 to 2.5.16, 2.3 to 2.3.34
- Netapp Active_iq_unified_manager
- Netapp Oncommand_insight
- Netapp Oncommand_workflow_automation
- Netapp Snapcenter
- Oracle Communications_policy_management
- Oracle Enterprise_manager_base_platform — versions 13.3.0.0, 13.4.0.0
- Oracle Mysql_enterprise_monitor
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply updates per vendor instructions.
Public proof-of-concept exploits
References
- security@apache.org (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
- security@apache.org (Exploit, VDB Entry, Third Party Advisory, exploit)
- security@apache.org (Exploit, VDB Entry, Third Party Advisory, exploit)
- security@apache.org (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
- security@apache.org (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
- security@apache.org (Exploit, VDB Entry, Third Party Advisory, exploit)
- security@apache.org (mailing-list, Mailing List)
- security@apache.org (Patch, Third Party Advisory)
- security@apache.org (Third Party Advisory)
- security@apache.org (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2018-11776?
- CVE-2018-11776 is a high-severity vulnerability in Apache Struts. CVSS score: 8.1/10. Published 2018-08-22.
- How severe is CVE-2018-11776?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2018-11776 known to be exploited?
- Yes. CVE-2018-11776 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating it is being actively exploited. 203 public proof-of-concept repositories are indexed.