Apache Struts CVE-2017-12611 Remote Code Execution Vulnerability

BID:100829

CVE-2017-12611 |

Info

Apache Struts CVE-2017-12611 Remote Code Execution Vulnerability

Bugtraq ID: 100829
Class: Input Validation Error
CVE: CVE-2017-12611
Remote: Yes
Local: No
Published: Sep 07 2017 12:00AM
Updated: Sep 27 2017 03:00PM
Credit: Lupin, David Greene and Roland McIntosh.
Vulnerable: Oracle Weblogic Server 10.3.6 0
Oracle Weblogic Server 12.2.1.3
Oracle Weblogic Server 12.2.1.2
Oracle Weblogic Server 12.2.1.1
Oracle Weblogic Server 12.2.1.0
Oracle Weblogic Server 12.1.3.0
Oracle Siebel Applications 7.1
Oracle Siebel Applications 6.2
Oracle Siebel Applications 16.1
Oracle MySQL Enterprise Monitor 3.2.1182
Oracle MySQL Enterprise Monitor 3.4.2.4181
Oracle MySQL Enterprise Monitor 3.4.1
Oracle MySQL Enterprise Monitor 3.4.0
Oracle MySQL Enterprise Monitor 3.3.4.3247
Oracle MySQL Enterprise Monitor 3.3.3.1199
Oracle MySQL Enterprise Monitor 3.3.2.1162
Oracle MySQL Enterprise Monitor 3.3.0.1098
Oracle MySQL Enterprise Monitor 3.2.8.2223
Oracle MySQL Enterprise Monitor 3.2.7.1204
Oracle MySQL Enterprise Monitor 3.2.5.1141
Oracle MySQL Enterprise Monitor 3.2.4.1102
Oracle MySQL Enterprise Monitor 3.2.1.1049
Oracle MICROS Retail XBRi Loss Prevention 10.8.1
Oracle MICROS Retail XBRi Loss Prevention 10.8
Oracle MICROS Retail XBRi Loss Prevention 10.7
Oracle MICROS Retail XBRi Loss Prevention 10.6
Oracle MICROS Retail XBRi Loss Prevention 10.5
Oracle MICROS Retail XBRi Loss Prevention 10.0.1
Oracle Insurance Performance Insight for General Insurance 8.0
Oracle Insurance Data Foundation 8.0.5
Oracle Insurance Data Foundation 8.0.4
Oracle Insurance Data Foundation 8.0.3
Oracle Insurance Data Foundation 8.0.2
Oracle Insurance Data Foundation 8.0.1
Oracle FLEXCUBE Private Banking 12.1
Oracle FLEXCUBE Private Banking 12.0.3
Oracle FLEXCUBE Private Banking 12.0.2
Oracle FLEXCUBE Private Banking 12.0.1
Oracle FLEXCUBE Private Banking 12.0
Oracle FLEXCUBE Private Banking 2.2
Oracle FLEXCUBE Private Banking 3.0
Oracle Financial Services Retail Performance Analytics 8.0.5
Oracle Financial Services Retail Performance Analytics 8.0.4
Oracle Financial Services Retail Performance Analytics 8.0.3
Oracle Financial Services Retail Performance Analytics 8.0.2
Oracle Financial Services Retail Performance Analytics 8.0.1
Oracle Financial Services Retail Performance Analytics 8.0
Oracle Financial Services Retail Customer Analytics 8.0.5
Oracle Financial Services Retail Customer Analytics 8.0.4
Oracle Financial Services Retail Customer Analytics 8.0.3
Oracle Financial Services Retail Customer Analytics 8.0.2
Oracle Financial Services Retail Customer Analytics 8.0.1
Oracle Financial Services Retail Customer Analytics 8.0
Oracle Financial Services Profitability Management 8.0.5
Oracle Financial Services Profitability Management 8.0.4
Oracle Financial Services Profitability Management 8.0.3
Oracle Financial Services Profitability Management 8.0.2
Oracle Financial Services Profitability Management 8.0.1
Oracle Financial Services Profitability Management 6.1.1
Oracle Financial Services Profitability Management 6.1
Oracle Financial Services Profitability Management 6.0
Oracle Financial Services Pricing Management 8.0.5
Oracle Financial Services Pricing Management 8.0.4
Oracle Financial Services Pricing Management 8.0
Oracle Financial Services Price Creation and Discovery 8.0.5
Oracle Financial Services Price Creation and Discovery 8.0.4
Oracle Financial Services Price Creation and Discovery 8.0
Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.5
Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.4
Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.3
Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.2
Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.1
Oracle Financial Services Loan Loss Forecasting and Provisioning 1.5.1
Oracle Financial Services Loan Loss Forecasting and Provisioning 1.5
Oracle Financial Services Liquidity Risk Management 8.0.4
Oracle Financial Services Liquidity Risk Management 8.0.2
Oracle Financial Services Liquidity Risk Management 8.0.1
Oracle Financial Services Institutional Performance Analytics 8.0.5
Oracle Financial Services Institutional Performance Analytics 8.0.4
Oracle Financial Services Institutional Performance Analytics 8.0.3
Oracle Financial Services Institutional Performance Analytics 8.0.2
Oracle Financial Services Institutional Performance Analytics 8.0.1
Oracle Financial Services Institutional Performance Analytics 8.0
Oracle Financial Services ICAAP Analytics 8.0
Oracle Financial Services Hedge Management and IFRS Valuations 8.0.5
Oracle Financial Services Hedge Management and IFRS Valuations 8.0.4
Oracle Financial Services Hedge Management and IFRS Valuations 8.0.3
Oracle Financial Services Hedge Management and IFRS Valuations 8.0.2
Oracle Financial Services Hedge Management and IFRS Valuations 8.0.1
Oracle Financial Services Hedge Management and IFRS Valuations 6.1.1
Oracle Financial Services Funds Transfer Pricing 8.0.5
Oracle Financial Services Funds Transfer Pricing 8.0.4
Oracle Financial Services Funds Transfer Pricing 8.0.3
Oracle Financial Services Funds Transfer Pricing 8.0.2
Oracle Financial Services Funds Transfer Pricing 8.0.1
Oracle Financial Services Funds Transfer Pricing 6.1.1
Oracle Financial Services Funds Transfer Pricing 6.1
Oracle Financial Services Funds Transfer Pricing 6.0
Oracle Financial Services Enterprise Financial Performance Analytics 8.0.5
Oracle Financial Services Enterprise Financial Performance Analytics 8.0.4
Oracle Financial Services Enterprise Financial Performance Analytics 8.0.3
Oracle Financial Services Enterprise Financial Performance Analytics 8.0.2
Oracle Financial Services Enterprise Financial Performance Analytics 8.0.1
Oracle Financial Services Enterprise Financial Performance Analytics 8.0
Oracle Financial Services Data Integration Hub 8.0.4
Oracle Financial Services Data Integration Hub 8.0.3
Oracle Financial Services Data Integration Hub 8.0.2
Oracle Financial Services Data Integration Hub 8.0.1
Oracle Financial Services Data Foundation 8.0.5
Oracle Financial Services Data Foundation 8.0.4
Oracle Financial Services Data Foundation 8.0.3
Oracle Financial Services Data Foundation 8.0.2
Oracle Financial Services Data Foundation 8.0.1
Oracle Financial Services Data Foundation 7.4
Oracle Financial Services Data Foundation 7.3
Oracle Financial Services Basel Regulatory Capital Internal Ratings Bas 8.0.4
Oracle Financial Services Basel Regulatory Capital Internal Ratings Bas 8.0.3
Oracle Financial Services Basel Regulatory Capital Internal Ratings Bas 8.0.2
Oracle Financial Services Basel Regulatory Capital Internal Ratings Bas 8.0.1
Oracle Financial Services Basel Regulatory Capital Basic 8.0.4
Oracle Financial Services Basel Regulatory Capital Basic 8.0.3
Oracle Financial Services Basel Regulatory Capital Basic 8.0.2
Oracle Financial Services Basel Regulatory Capital Basic 8.0.1
Oracle Financial Services Asset Liability Management 8.0.5
Oracle Financial Services Asset Liability Management 8.0.4
Oracle Financial Services Asset Liability Management 8.0.3
Oracle Financial Services Asset Liability Management 8.0.2
Oracle Financial Services Asset Liability Management 8.0.1
Oracle Financial Services Asset Liability Management 6.1.1
Oracle Financial Services Asset Liability Management 6.1
Oracle Financial Services Asset Liability Management 6.0
Oracle Financial Services Analytical Applications Reconciliation 8.0.4
Oracle Financial Services Analytical Applications Reconciliation 8.0.3
Oracle Financial Services Analytical Applications Reconciliation 8.0.2
Oracle Financial Services Analytical Applications Reconciliation 8.0.1
Oracle Financial Services Analytical Applications Reconciliation 8.0
Oracle Financial Services Analytical Applications Reconciliation 3.5.1
Oracle Financial Services Analytical Applications Reconciliation 3.5
Oracle Financial Services Analytical Applications Infrastructure 7.3
Oracle Financial Services Analytical Applications Infrastructure 7.2
Oracle Communications Policy Management 12.1.1
Oracle Communications Policy Management 12.1
Oracle Communications Policy Management 11.5
Oracle Communications Policy Management 12.2
Cisco Video Distribution Suite for Internet Streaming VDS-IS 0
Cisco Network Performance Analysis 0
Cisco MXE 3500 Series Media Experience Engines 0
Cisco Digital Media Manager (DMM) 0
Apache Struts 2.3.31
Apache Struts 2.3.30
Apache Struts 2.3.28
Apache Struts 2.3.24
Apache Struts 2.3.5
Apache Struts 2.3.4 1
Apache Struts 2.3.4
Apache Struts 2.2.3
Apache Struts 2.2.1 1
Apache Struts 2.2
Apache Struts 2.1.8
Apache Struts 2.1.6
Apache Struts 2.1.5
Apache Struts 2.1.2
Apache Struts 2.1.1
Apache Struts 2.1.1
Apache Struts 2.1
Apache Struts 2.0.14
Apache Struts 2.0.12
Apache Struts 2.0.11
Apache Struts 2.0.10
Apache Struts 2.0.9
Apache Struts 2.0.8
Apache Struts 2.0.7
Apache Struts 2.0.6
Apache Struts 2.0.5
Apache Struts 2.0.4
Apache Struts 2.0.3
Apache Struts 2.0.2
Apache Struts 2.0.1
Apache Struts 2.0
Apache Struts 2.5.9
Apache Struts 2.5.8
Apache Struts 2.5.7
Apache Struts 2.5.6
Apache Struts 2.5.5
Apache Struts 2.5.4
Apache Struts 2.5.3
Apache Struts 2.5.2
Apache Struts 2.5.10
Apache Struts 2.5.1
Apache Struts 2.5
Apache Struts 2.3.8
Apache Struts 2.3.7
Apache Struts 2.3.33
Apache Struts 2.3.32
Apache Struts 2.3.29
Apache Struts 2.3.28.1
Apache Struts 2.3.24.3
Apache Struts 2.3.24.2
Apache Struts 2.3.24.1
Apache Struts 2.3.20.3
Apache Struts 2.3.20.2
Apache Struts 2.3.20.1
Apache Struts 2.3.20
Apache Struts 2.3.16.3
Apache Struts 2.3.16.2
Apache Struts 2.3.16.1
Apache Struts 2.3.16
Apache Struts 2.3.15.3
Apache Struts 2.3.15.2
Apache Struts 2.3.15.1
Apache Struts 2.3.15
Apache Struts 2.3.14.3
Apache Struts 2.3.14.2
Apache Struts 2.3.14.1
Apache Struts 2.3.14
Apache Struts 2.3.1.2
Apache Struts 2.3.1.1
Apache Struts 2.3.1
Apache Struts 2.2.3.1
Apache Struts 2.1.4
Apache Struts 2.1.3
Apache Struts 2.0.13
Not Vulnerable: Apache Struts 2.5.12
Apache Struts 2.3.34

Discussion

Apache Struts CVE-2017-12611 Remote Code Execution Vulnerability

Apache Struts is prone to a remote code-execution vulnerability.

Successfully exploiting this issue may allow an attacker to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

Apache Struts 2.0.1 through 2.3.33 and 2.5 through 2.5.10 are vulnerable.

Exploit / POC

Apache Struts CVE-2017-12611 Remote Code Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Solution / Fix

Apache Struts CVE-2017-12611 Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

References

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report