Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2018-11776: Apache Struts can allow remote code execution
CVE-2018-11776 · published 8 years ago · actively exploited
Summary
Apache Struts and any NetApp products that include its core library may let an attacker run malicious code on your server if certain configuration settings are left open. This can happen when namespace settings are missing or too broad, or when URL tags are not properly defined. Update to the latest patched version of Struts and review your configuration to ensure namespaces are locked down and all tags specify safe values.
What to do
- Update apache org.apache.struts:struts2-core to version 2.3.35.
- Update apache org.apache.struts:struts2-core to version 2.5.17.
- Update oracle communications_policy_management to version 12.5.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | apache | struts |
>= 2.0.4, < 2.3.35 >= 2.5.0, < 2.5.17 |
| maven | apache | org.apache.struts:struts2-core |
>= 2.0.4, <= 2.3.34 >= 2.5, <= 2.5.16 Fix: upgrade to 2.3.35
|
| – | netapp | active_iq_unified_manager |
>= 7.3 >= 9.5 cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:* |
| – | netapp | oncommand_insight |
All versions
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* |
| – | netapp | oncommand_workflow_automation |
All versions
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* |
| – | netapp | snapcenter |
All versions
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* |
| – | oracle | communications_policy_management |
< 12.5.0 cpe:2.3:a:oracle:communications_policy_management:*:*:*:*:*:*:*:* |
| – | oracle | enterprise_manager_base_platform |
13.3.0.0 13.4.0.0 cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:* |
| – | oracle | mysql_enterprise_monitor |
<= 3.4.9.4237 >= 4.0.0, <= 4.0.6.5281 >= 8.0.0, <= 8.0.2.8191 cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* |
Original advisory text
Apache Struts Remote Code Execution Vulnerability
Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace. Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-11776
- https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0...
- https://github.com/apache/struts/commit/6e87474f9ad0549f07dd2c37d50a9ccd0977c6e
- https://web.archive.org/web/20180822160726/http://www.securityfocus.com/bid/1051...
- https://web.archive.org/web/20200807025819/http://www.securitytracker.com/id/104...
- https://web.archive.org/web/20201208145803/https://securitytracker.com/id/104154...
- https://www.exploit-db.com/exploits/45367
- https://www.exploit-db.com/exploits/45262
- https://www.exploit-db.com/exploits/45260
- https://security.netapp.com/advisory/ntap-20181018-0002
- https://security.netapp.com/advisory/ntap-20180822-0001
- https://github.com/advisories/GHSA-cr6j-3jp9-rw65
- https://www.exploit-db.com/exploits/45260/ Exploit
- https://www.exploit-db.com/exploits/45262/ Exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-... URL
- http://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.... Vendor Advisory
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txt Vendor Advisory
- http://www.securityfocus.com/bid/105125 Vendor Advisory
- http://www.securitytracker.com/id/1041547 Vendor Advisory
- http://www.securitytracker.com/id/1041888 Vendor Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0012 Vendor Advisory
- https://security.netapp.com/advisory/ntap-20180822-0001/ Vendor Advisory
- https://security.netapp.com/advisory/ntap-20181018-0002/ Vendor Advisory
- https://www.oracle.com/security-alerts/cpujul2020.html Vendor Advisory
- https://cwiki.apache.org/confluence/display/WW/S2-057 Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787... Patch
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch
- https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0... Third Party Advisory
- https://github.com/hook-s3c/CVE-2018-11776-Python-PoC Exploit
- https://lgtm.com/blog/apache_struts_CVE-2018-11776 Exploit
- https://www.exploit-db.com/exploits/45367/ Exploit
Internet-facing
3 days
and check for signs of compromise
Internal
14 days
- Known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.1
High
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
>99%
chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published22 Aug 2018
Updated20 Oct 2026
First seen6 Mar 2026
Sources
CVE-2018-11776 · CISA KEV
CVE-2018-11776 · NVD
GHSA-cr6j-3jp9-rw65 · GHSA
CVE-2018-11776 · OSV
Track software like this
Free during beta