VulnerabilityAnalyzed

CVE-2018-11776

Apache Struts Remote Code Execution Vulnerability

KEVEXPLOIT ×3 ✓HIGH 8.1EPSS 100.0%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 3 May 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.

CVSS 3.1: 8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 100.00% probability · 100th percentile
Public exploits: 3 in Exploit-DB · verified · first 25 August 2018
CISA KEV: Listed 3 November 2021 · due 3 May 2022
Affected: apache/struts · netapp/active iq unified manager · netapp/oncommand insight · netapp/oncommand workflow automation · netapp/snapcenter · oracle/communications policy management · oracle/enterprise manager base platform · oracle/mysql enterprise monitor
Source: security@apache.org

EPSS trend

EPSS 100.0% since 27 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

CISA notes

Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2018-11776

Public exploits (3)

Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.

EDB-ID	Title	Type	Published	Verified
EDB-45367 source ↗	Apache Struts 2 - Namespace Redirect OGNL Injection (Metasploit)multiple · Metasploit	remote	10 September 2018	yes
EDB-45260 source ↗	Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (1)linux · Mazin Ahmed	remote	26 August 2018	no
EDB-45262 source ↗	Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (2)multiple · hook-s3c	remote	25 August 2018	no

References

http://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txtBroken Link, Mailing List, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlPatch, Third Party Advisory
http://www.securityfocus.com/bid/105125Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041547Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041888Broken Link, Third Party Advisory, VDB Entry
https://cwiki.apache.org/confluence/display/WW/S2-057Issue Tracking, Third Party Advisory
https://github.com/hook-s3c/CVE-2018-11776-Python-PoCExploit, Third Party Advisory
https://lgtm.com/blog/apache_struts_CVE-2018-11776Exploit, Third Party Advisory
https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3EMailing List
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0012Third Party Advisory
https://security.netapp.com/advisory/ntap-20180822-0001/Third Party Advisory
https://security.netapp.com/advisory/ntap-20181018-0002/Third Party Advisory
https://www.exploit-db.com/exploits/45260/Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/45262/Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/45367/Exploit, Third Party Advisory, VDB Entry
https://www.oracle.com/security-alerts/cpujul2020.htmlThird Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlPatch, Third Party Advisory
http://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txtBroken Link, Mailing List, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlPatch, Third Party Advisory
http://www.securityfocus.com/bid/105125Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041547Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041888Broken Link, Third Party Advisory, VDB Entry
https://cwiki.apache.org/confluence/display/WW/S2-057Issue Tracking, Third Party Advisory
https://github.com/hook-s3c/CVE-2018-11776-Python-PoCExploit, Third Party Advisory
https://lgtm.com/blog/apache_struts_CVE-2018-11776Exploit, Third Party Advisory
https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3EMailing List

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.