critical9.8Public exploit code
CVE-2017-12611
In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Apache Struts 2.0.1 < 2.3.33 / 2.5 < 2.5.10 - Arbitrary Code Execution2017-09-08 · remote · multiple · Verified
Impact
In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Struts | Versions 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
- http://www.securityfocus.com/bid/100829
- https://kb.netapp.com/support/s/article/ka51A000000CgttQAC/NTAP-20170911-0001
- https://struts.apache.org/docs/s2-053.html
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
- http://www.securityfocus.com/bid/100829
- https://kb.netapp.com/support/s/article/ka51A000000CgttQAC/NTAP-20170911-0001
- https://struts.apache.org/docs/s2-053.html