CVE-2018-11776
Summary
| CVE | CVE-2018-11776 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-08-22 13:29:00 UTC |
| Updated | 2023-11-07 02:51:00 UTC |
| Description | Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace. |
Risk And Classification
EPSS: 0.944310000 probability, percentile 0.999850000 (date 2026-04-01)
CISA KEV: Listed on 2021-11-03; due 2022-05-03; ransomware use Unknown
Problem Types: CWE-20
CISA Known Exploited Vulnerability
| Vendor | Apache |
|---|---|
| Product | Struts |
| Name | Apache Struts Remote Code Execution Vulnerability |
| Required Action | Apply updates per vendor instructions. |
| Notes | https://nvd.nist.gov/vuln/detail/CVE-2018-11776 |
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Apache Struts 2 - Namespace Redirect OGNL Injection (Metasploit) - Multiple remote Exploit | EXPLOIT-DB | www.exploit-db.com | Exploit, Third Party Advisory, VDB Entry |
| Security Advisory | CONFIRM | psirt.global.sonicwall.com | Third Party Advisory |
| Apache Struts Remote Code Execution ≈ Packet Storm | MISC | packetstormsecurity.com | |
| GitHub - hook-s3c/CVE-2018-11776-Python-PoC: Working Python test and PoC for CVE-2018-11776, includes Docker lab | MISC | github.com | Exploit, Third Party Advisory |
| Oracle Critical Patch Update Advisory - July 2020 | MISC | www.oracle.com | |
| Pony Mail! | MLIST | lists.apache.org | |
| Oracle Security Alert CVE-2018-11776 | CONFIRM | www.oracle.com | Patch, Third Party Advisory |
| www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txt | CONFIRM | www.arubanetworks.com | Mailing List, Third Party Advisory |
| CVE-2018-11776: How to find 5 RCEs in Apache Struts with Semmle QL - Blog - LGTM | MISC | lgtm.com | Exploit, Third Party Advisory |
| S2-057 - DEPRECATED: Apache Struts 2 Documentation - Apache Software Foundation | CONFIRM | cwiki.apache.org | Issue Tracking, Third Party Advisory |
| MySQL Multiple Flaws Let Remote Users Gain Elevated Privileges, Remote Authenticated Users Access and Modify Data, and Remote and Local Users Deny Service - SecurityTracker | SECTRACK | www.securitytracker.com | Third Party Advisory, VDB Entry |
| Pony Mail! | lists.apache.org | ||
| Oracle Critical Patch Update - January 2019 | CONFIRM | www.oracle.com | Patch, Third Party Advisory |
| October 2018 MySQL Vulnerabilities in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | Third Party Advisory |
| Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (1) | EXPLOIT-DB | www.exploit-db.com | Exploit, Third Party Advisory, VDB Entry |
| Apache Struts Undefined Namespace Processing Lets Remote Users Execute Arbitrary Code on the Target System - SecurityTracker | SECTRACK | www.securitytracker.com | Third Party Advisory, VDB Entry |
| CPU Oct 2018 | CONFIRM | www.oracle.com | Patch, Third Party Advisory |
| Apache Struts CVE-2018-11776 Remote Code Execution Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (2) | EXPLOIT-DB | www.exploit-db.com | Exploit, Third Party Advisory, VDB Entry |
| CVE-2018-11776 Apache Struts Vulnerability in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 981120 Java (maven) Security Update for org.apache.struts:struts2-core (GHSA-cr6j-3jp9-rw65)