Apache Struts 2.x Remote Code Execution Vulnerability

🗓️ 24 Aug 2018 00:00:00Reported by Man Yue MoType

zdt🔗 0day.today👁 236 Views

Apache Struts 2.x Remote Code Execution Vulnerability in 2.3 to 2.3.34 and 2.5 to 2.5.1

Reporter	Title	Published	Views	Family All 99
Dsquare	Apache Struts 2 Multiple Tags Result Namespace Handling RCE	20 Oct 201800:00	–	dsquare
exploitpack	Apache Struts 2.3 2.3.34 2.5 2.5.16 - Remote Code Execution (1)	26 Aug 201800:00	–	exploitpack
RedhatCVE	CVE-2018-11776	22 Aug 201808:49	–	redhatcve
IBM Security Bulletins	Security Bulletin: Content Collector for Email, File Systems, Microsoft SharePoint and IBM Connections are affected by a publicly disclosed vulnerability found by vFinder: Eclipse Jetty	12 Nov 201812:55	–	ibm
IBM Security Bulletins	Security Bulletin: Public disclosed vulnerability from Apache Struts affects IBM Spectrum LSF Explorer	25 Sep 201813:15	–	ibm
IBM Security Bulletins	Security Bulletin: Public disclosed vulnerability from Apache Struts affects IBM Platform Application Center	25 Sep 201813:15	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Struts affects IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (CVE-2018-11776)	29 Mar 202301:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by a Publicly disclosed Apache Struts vulnerability	28 Sep 201804:30	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in Apache Struts affects the IBM FlashSystem 840 and 900	18 Feb 202301:45	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in Apache Struts affects the IBM FlashSystem V840	18 Feb 201915:05	–	ibm

[CVEID]:CVE-2018-11776
[PRODUCT]:Apache Struts
[VERSION]:Apache Struts 2.3 to 2.3.34 and 2.5 to 2.5.16
[PROBLEMTYPE]:Remote Code Execution
[REFERENCES]:https://cwiki.apache.org/confluence/display/WW/S2-057
[DESCRIPTION]:Man Yue Mo from the Semmle Security Research team was
noticed that Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16
suffer from possible Remote Code Execution when using results with no
namespace and in same time, its upper action(s) have no or wildcard
namespace. Same possibility when using url tag which doesnat have value
and action set and in same time, its upper action(s) have no or wildcard
namespace.

#  0day.today [2018-08-28]  #

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

24 Aug 2018 00:00Current

0.7Low risk

Vulners AI Score0.7

EPSS0.973