High severity · published Aug 22, 2018
CVE-2018-11776
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like…
In wildKEV
8.1
CVSS
100%
EPSS
Yes
On KEV
Description
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)100.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 3, 2021
Federal remediation dueMay 3, 2022
Ransomware campaign useNot known
Affected products
Which versions
ST
Struts · Apache
2.3 to 2.3.34; 2.5 to 2.5.16 · source: vendor, NVD, KEV
AI
Active IQ Unified Manager · Netapp
7.3 and later; 9.5 and later · source: NVD
CP
Communications Policy Management · Oracle
before 12.5.0 · source: NVD
EM
Enterprise Manager Base Platform · Oracle
13.3.0.0; 13.4.0.0 · source: NVD
ME
Mysql Enterprise Monitor · Oracle
through 3.4.9.4237; 4.0.0 through 4.0.6.5281; 8.0.0 through 8.0.2.8191 · source: NVD
OI
Oncommand Insight · Netapp
All versions, or not specified · source: NVD
OW
Oncommand Workflow Automation · Netapp
All versions, or not specified · source: NVD
SN
Snapcenter · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-11776
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-11776
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Third Party Advisory
http://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.html
Broken Link
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txt
Patch
http://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787.html
Patch
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Broken Link
http://www.securityfocus.com/bid/105125
Broken Link
http://www.securitytracker.com/id/1041547
More from Struts
9.8
CVE-2020-17530
Apache Struts Remote Code Execution Vulnerability
9.8
CVE-2017-9791
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage
9.8
CVE-2017-5638
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload…
9.8
CVE-2013-2251
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction:…
9.8
CVE-2012-0391
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of…