Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-CR6J-3JP9-RW65
HistoryOct 18, 2018 - 7:24 p.m.

Apache Struts vulnerable to remote command execution (RCE) due to improper input validation

2018-10-1819:24:38
CWE-20
GitHub Advisory Database
github.com
218

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.975

Percentile

100.0%

JSON

Apache Struts contains a Remote Code Execution when using results with no namespace and it’s upper actions have no or wildcard namespace. The same flaw exists when using a url tag with no value, action set, and it’s upper actions have no or wildcard namespace.

Affected configurations

Vulners
Node
org.apache.strutsstruts2-coreRange2.5–2.5.16
OR
org.apache.strutsstruts2-coreRange2.0.4–2.3.34
VendorProductVersionCPE
org.apache.strutsstruts2-core*cpe:2.3:a:org.apache.struts:struts2-core:*:*:*:*:*:*:*:*

References

Related

ibm 8
cisco 1
threatpost 20
osv 2
openvas 3
nuclei 1
kitploit 5
talosblog 1
qualysblog 3
metasploit 1
nessus 7
packetstorm 3
zdt 4
exploitpack 1
dsquare 1
redhatcve 1
checkpoint_advisories 1
ubuntucve 1
exploitdb 3
cvelist 1
myhack58 3
f5 1
veracode 1
prion 1
akamaiblog 1
cisa_kev 1
krebs 1
trendmicroblog 1
nvd 1
cve 1
attackerkb 3
impervablog 2
githubexploit 5
thn 3
rapid7blog 1
github 1
fireeye 1
oracle 3
ibm
ibm
Security Bulletin: Public disclosed vulnerability from Apache Struts affects IBM Spectrum LSF Explorer
2018-09-25 13:15:02
Security Bulletin: Public disclosed vulnerability from Apache Struts affects IBM Platform Application Center
2018-09-25 13:15:02
Security Bulletin: Vulnerability in Apache Struts affects IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (CVE-2018-11776)
2023-03-29 01:48:02
cisco
cisco
Apache Struts Remote Code Execution Vulnerability Affecting Cisco Products: August 2018
2018-08-23 20:00:00
threatpost
threatpost
Gitrob Combs Github Repositories for Secret Company Data
2015-01-13 12:55:07
Protecting Cloud APIs Critical to Mitigating Total Compromise
2016-05-19 14:20:22
GitHub Code Execution Bug Fetches $18,000 Bounty
2017-03-17 09:00:04
osv
osv
Apache Struts vulnerable to remote command execution (RCE) due to improper input validation
2018-10-18 19:24:38
CVE-2018-11776
2018-08-22 13:29:00
openvas
openvas
Huawei Data Communication: Apache Struts2 S2-057 Remote Code Execution Vulnerability in Some Huawei Products (huawei-sa-20181121-01-struts2)
2020-06-05 00:00:00
Apache Struts Security Update (S2-057) - Version Check
2018-08-23 00:00:00
Apache Struts Security Update (S2-057) - Active Check
2018-08-27 00:00:00
nuclei
nuclei
Apache Struts2 S2-057 - Remote Code Execution
2021-02-24 04:29:30
kitploit
kitploit
Mitaka - A Browser Extension For OSINT Search
2019-09-21 12:00:00
Apache Struts v3 - Tool To Exploit 3 RCE Vulnerabilities On ApacheStruts
2018-08-26 21:14:00
Sn1per v7.0 - Automated Pentest Framework For Offensive Security Experts
2019-05-12 13:09:00
talosblog
talosblog
Connecting the dots between recently active cryptominers
2018-12-18 08:33:00
qualysblog
qualysblog
Security News: Hackers Aim Ransomware at Big Cos., as Experts Call for Swift Patching of Struts Bug
2018-08-27 18:32:33
Detecting Apache Struts 2 Namespace RCE: CVE-2018-11776
2018-08-23 20:27:19
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR
2022-02-23 05:39:00
metasploit
metasploit
Apache Struts 2 Namespace Redirect OGNL Injection
2018-08-31 18:48:22
nessus
nessus
Apache Struts CVE-2018-11776 Results With No Namespace Remote Code Execution (S2-057) (remote)
2018-08-23 00:00:00
Cisco Unified Communication Manager Apache Struts RCE (CSCvm14042)
2018-09-05 00:00:00
Apache Struts CVE-2018-11776 Results With No Namespace Possible Remote Code Execution (S2-057)
2018-08-22 00:00:00
packetstorm
packetstorm
Apache Struts 2.3 / 2.5 Remote Code Execution
2018-08-26 00:00:00
Apache Struts 2 Namespace Redirect OGNL Injection
2018-09-07 00:00:00
Apache Struts 2.3 / 2.5 Remote Code Execution
2018-08-25 00:00:00
zdt
zdt
Apache Struts 2 Namespace Redirect OGNL Injection Exploit
2018-09-08 00:00:00
Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (1) Exploit
2018-08-28 00:00:00
Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (2) Exploit
2018-08-28 00:00:00
exploitpack
exploitpack
Apache Struts 2.3 2.3.34 2.5 2.5.16 - Remote Code Execution (1)
2018-08-26 00:00:00
dsquare
dsquare
Apache Struts 2 Multiple Tags Result Namespace Handling RCE
2018-10-20 00:00:00
redhatcve
redhatcve
CVE-2018-11776
2018-08-22 08:49:33
checkpoint_advisories
checkpoint_advisories
Apache Struts Remote Code Execution (CVE-2018-11776)
2018-08-23 00:00:00
ubuntucve
ubuntucve
CVE-2018-11776
2018-08-22 00:00:00
exploitdb
exploitdb
Apache Struts 2.3 &lt; 2.3.34 / 2.5 &lt; 2.5.16 - Remote Code Execution (2)
2018-08-25 00:00:00
Apache Struts 2.3 &lt; 2.3.34 / 2.5 &lt; 2.5.16 - Remote Code Execution (1)
2018-08-26 00:00:00
Apache Struts 2 - Namespace Redirect OGNL Injection (Metasploit)
2018-09-10 00:00:00
cvelist
cvelist
CVE-2018-11776
2018-08-22 13:00:00
myhack58
myhack58
Apache Struts2 S2-057 vulnerability analysis and early warning-vulnerability warning-the black bar safety net
2018-08-23 00:00:00
Apache Struts OGNL injection vulnerability principle with an example-vulnerability warning-the black bar safety net
2019-03-30 00:00:00
S2-057 vulnerability in the original author's README: how to use automated tools find 5 RCE-vulnerability warning-the black bar safety net
2018-08-23 00:00:00
f5
f5
K60499474 : Apache Struts vulnerability CVE-2018-11776
2018-08-24 00:00:00
veracode
veracode
Remote Code Execution (RCE)
2018-08-22 17:36:38
prion
prion
Remote code execution
2018-08-22 13:29:00
akamaiblog
akamaiblog
Web Application and API Protection -- From SQL Injection to Magecart
2020-09-09 13:00:00
cisa_kev
cisa_kev
Apache Struts Remote Code Execution Vulnerability
2021-11-03 00:00:00
krebs
krebs
Experts Urge Rapid Patching of ‘Struts’ Bug
2018-08-23 20:22:35
trendmicroblog
trendmicroblog
Server Security for the Modern IT Ecosystem
2019-01-03 15:30:46
nvd
nvd
CVE-2018-11776
2018-08-22 13:29:00
cve
cve
CVE-2018-11776
2018-08-22 13:29:00
attackerkb
attackerkb
CVE-2018-11776
2018-08-22 00:00:00
CVE-2019-0230
2020-09-14 00:00:00
CVE-2022-26134
2022-06-03 00:00:00
impervablog
impervablog
Read: Apache Struts Patches ‘Critical Vulnerability’ CVE-2018-11776
2018-08-23 14:25:36
The World’s Most Popular Coding Language Happens to be Most Hackers’ Weapon of Choice
2018-09-26 16:18:36
githubexploit
githubexploit
Exploit for Injection in Atlassian Confluence
2021-10-06 23:24:24
Exploit for Injection in Atlassian Confluence
2021-10-06 23:24:24
Exploit for Injection in Atlassian Confluence
2021-10-06 23:24:24
thn
thn
Cisco Issues Security Patch Updates for 32 Flaws in its Products
2018-09-06 08:45:00
New Apache Struts RCE Flaw Lets Hackers Take Over Web Servers
2018-08-22 14:04:00
Top 15 Vulnerabilities Attackers Exploited Millions of Times to Hack Linux Systems
2021-08-23 13:27:00
rapid7blog
rapid7blog
Active Exploitation of Confluence CVE-2022-26134
2022-06-02 23:27:15
github
github
Bypassing OGNL sandboxes for fun and charities
2023-01-27 16:00:49
fireeye
fireeye
Think Fast: Time Between Disclosure, Patch Release and Vulnerability Exploitation — Intelligence for Vulnerability Management, Part Two
2020-04-13 00:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - January 2019
2019-01-15 00:00:00
Oracle Critical Patch Update - October 2018
2018-12-18 00:00:00
Oracle Critical Patch Update Advisory - July 2020
2020-07-14 00:00:00

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.975

Percentile

100.0%

JSON
Related for GHSA-CR6J-3JP9-RW65
ibm8cisco1threatpost20osv2openvas3nuclei1kitploit5talosblog1qualysblog3metasploit1nessus7packetstorm3zdt4exploitpack1dsquare1redhatcve1checkpoint_advisories1ubuntucve1exploitdb3cvelist1myhack583f51veracode1prion1akamaiblog1cisa_kev1krebs1trendmicroblog1nvd1cve1attackerkb3impervablog2githubexploit5thn3rapid7blog1github1fireeye1oracle3