Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

GHSA-J77Q-2QQG-6989 Apache Struts vulnerable to remote arbitrary command execution due to improper input validation

🗓️ 18 Oct 2018 19:24:26Reported by GoogleType 
osv
 osv🔗 osv.dev👁 8 Views

Apache Struts prior to 2.3.32 and 2.5.10.1 allow remote code execution via crafted headers during file upload.

Related
Refs
ReporterTitlePublishedViews
Family
ibm		Security Bulletin: A vulnerability in Apache Struts 2 affects IBM Platform Symphony and IBM Spectrum Symphony (CVE-2017-5638)
18 Jun 201801:35
–ibm
ibm		Security Bulletin:Vulnerability in Apache Struts affects Storwize V7000 Unified (CVE-2017-5638)
18 Jun 201800:34
–ibm
ibm		Security Bulletin: Apache Struts v2 Jakarta Multipart parser code execution affects IBM Platform Cluster Manager Standard Edition, IBM Platform Cluster Manager Advanced Edition, Platform HPC, and Spectrum Cluster Foundation (CVE-2017-5638)
18 Jun 201801:35
–ibm
ibm		Security Bulletin: Vulnerability in Apache Struts affects IBM Social Media Analytics (CVE-2017-5638)
15 Jun 201822:50
–ibm
ibm		Security Bulletin: A vulnerability in Apache Struts affects the IBM FlashSystem model V840
18 Jun 201800:32
–ibm
ibm		Security Bulletin: IBM Sterling Order Management is affected by a vulnerability (CVE-2017-5638)
16 Jun 201820:09
–ibm
ibm		WebSphere Application Server and IBM HTTP Server Security Bulletin List
13 Jul 202218:04
–ibm
ibm		Security Bulletin: A vulnerability in Apache Struts affects the IBM FlashSystem models 840 and 900
18 Feb 202301:45
–ibm
ibm		Security Bulletin: Vulnerability in Apache Struts affects SAN Volume Controller, Storwize family and FlashSystem V9000 products (CVE-2017-5638)
29 Mar 202301:48
–ibm
ibm		Security Bulletin: IBM OpenPages GRC Platform Web Applications are not vulnerable to (CVE-2017-5638)
15 Jun 201822:49
–ibm
Rows per page
SourceLink
nvdwww.nvd.nist.gov/vuln/detail/CVE-2017-5638
githubwww.github.com/rapid7/metasploit-framework/issues/8064
githubwww.github.com/apache/struts/commit/b06dd50af2a3319dd896bf5c2f4972d2b772cf2b
githubwww.github.com/apache/struts/commit/352306493971e7d5a756d61780d57a76eb1f519a
listswww.lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3Cannounce.apache.org%3E
listswww.lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E
listswww.lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922@%3Cannounce.apache.org%3E
nmapwww.nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html
packetstormsecuritywww.packetstormsecurity.com/files/141494/S2-45-poc.py.txt
securitywww.security.netapp.com/advisory/ntap-20170310-0001
Rows per page

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
22 Oct 2025 19:26Current
7.6High risk
Vulners AI Score7.6
CVSS 310
EPSS0.99999
apache strutsremote executioncrafted headersfile uploadjakarta multipart parser
8