CVE Watch—

CVE-2018-11776

Apache Struts Remote Code Execution Vulnerability

CVSS

—

Sem CVSS

EPSS

100.0%

p100

KEV

SIM

3 de nov. de 2021

Exploit Today

0-100

Publicado: — · Última mod.: —

EPSS · 30d

100.0%EPSS · 30 dias100.0%

2026-10-082026-11-05

Ficha do catálogo KEV

Produto

Apache / Struts

Vulnerabilidade

Apache Struts Remote Code Execution Vulnerability

Adicionado ao KEV

3 de nov. de 2021

Corrigir até

3 de mai. de 2022

Uso conhecido em ransomware

Não

Descrição resumida

Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace. Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.

Ação necessária

Apply updates per vendor instructions.

Notas

https://nvd.nist.gov/vuln/detail/CVE-2018-11776

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2016-30818.1 ALT

99.9%

KEV—80Apache Struts Command Injection Vulnerability27d CVE-2013-2251—

100.0%

KEV—80Apache Struts Improper Input Validation Vulnerability—CVE-2017-5638—

100.0%

KEV—80Apache Struts Remote Code Execution Vulnerability—CVE-2017-9805—

99.9%

KEV—80Apache Struts Deserialization of Untrusted Data Vulnerability—CVE-2020-17530—

99.9%

KEV—80Apache Struts Remote Code Execution Vulnerability—