logo

Database

Lack of data validation In org.apache.struts:struts2-core

Description

Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literal In Apache Struts 2.0.1 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2017-126112. NVD-2017-126113. OSV-2017-126114. GCVE-2017-12611

References

1. https://github.com/apache/struts/commit/2306f5f7fad7f0157f216f34331238feb0539fa2. https://github.com/apache/struts/commit/637ad1c3707266c33daabb18d7754e795e6681f3. https://kb.netapp.com/support/s/article/ka51A000000CgttQAC/NTAP-20170911-00014. https://struts.apache.org/docs/s2-053.html5. https://web.archive.org/web/20170923161654/http://www.securityfocus.com/bid/1008296. http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt7. http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html8. https://vulncheck.com/cve/CVE-2017-126119. https://www.exploit-db.com/exploits/4455610. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12611.yaml11. https://github.com/brianwrf/S2-053-CVE-2017-12611

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.