Known Exploited Vulnerability
9.8
CRITICAL
CVE-2017-5638
Apache Struts Remote Code Execution Vulnerability - [Actively Exploited]
Description

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

INFO

Published Date :

March 11, 2017, 2:59 a.m.

Last Modified :

Nov. 21, 2024, 3:28 a.m.

Source :

[email protected]

Remotely Exploitable :

Yes !

Impact Score :

5.9

Exploitability Score :

3.9
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.

Required Action :

Apply updates per vendor instructions.

Notes :

https://nvd.nist.gov/vuln/detail/CVE-2017-5638

Public PoC/Exploit Available at Github

CVE-2017-5638 has a 276 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2017-5638 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Ibm storwize_v7000_firmware
2 Ibm storwize_v5000_firmware
3 Ibm storwize_v3500_firmware
4 Ibm storwize_v7000
5 Ibm storwize_v3500
6 Ibm storwize_v5000
1 Lenovo storage_v5030_firmware
2 Lenovo storage_v5030
1 Oracle weblogic_server
1 Netapp oncommand_balance
1 Apache struts
1 Arubanetworks clearpass_policy_manager
1 Hp server_automation
: Total Affected Vendor : 7 | Products : 13
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2017-5638.

URL Resource
http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html Exploit Third Party Advisory
http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/ Exploit Third Party Advisory
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt Third Party Advisory
http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html Press/Media Coverage Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html Patch Third Party Advisory
http://www.securityfocus.com/bid/96729 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1037973 Broken Link Third Party Advisory VDB Entry
https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/ Exploit Press/Media Coverage
https://cwiki.apache.org/confluence/display/WW/S2-045 Mitigation Vendor Advisory
https://cwiki.apache.org/confluence/display/WW/S2-046 Mitigation Vendor Advisory
https://exploit-db.com/exploits/41570 Exploit Third Party Advisory VDB Entry
https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519a Broken Link
https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228 Broken Link
https://github.com/mazen160/struts-pwn Exploit
https://github.com/rapid7/metasploit-framework/issues/8064 Exploit Issue Tracking
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03733en_us Broken Link
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03749en_us Third Party Advisory
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_us Third Party Advisory
https://isc.sans.edu/diary/22169 Exploit Third Party Advisory
https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E Mailing List
https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html Exploit Third Party Advisory
https://packetstormsecurity.com/files/141494/S2-45-poc.py.txt Exploit Third Party Advisory VDB Entry
https://security.netapp.com/advisory/ntap-20170310-0001/ Third Party Advisory
https://struts.apache.org/docs/s2-045.html Mitigation Vendor Advisory
https://struts.apache.org/docs/s2-046.html Mitigation Vendor Advisory
https://support.lenovo.com/us/en/product_security/len-14200 Third Party Advisory
https://twitter.com/theog150/status/841146956135124993 Broken Link Third Party Advisory
https://www.exploit-db.com/exploits/41614/ Exploit Third Party Advisory VDB Entry
https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/ Third Party Advisory
https://www.kb.cert.org/vuls/id/834067 Third Party Advisory US Government Resource
https://www.symantec.com/security-center/network-protection-security-advisories/SA145 Broken Link
http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html Exploit Third Party Advisory
http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/ Exploit Third Party Advisory
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt Third Party Advisory
http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html Press/Media Coverage Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html Patch Third Party Advisory
http://www.securityfocus.com/bid/96729 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1037973 Broken Link Third Party Advisory VDB Entry
https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/ Exploit Press/Media Coverage
https://cwiki.apache.org/confluence/display/WW/S2-045 Mitigation Vendor Advisory
https://cwiki.apache.org/confluence/display/WW/S2-046 Mitigation Vendor Advisory
https://exploit-db.com/exploits/41570 Exploit Third Party Advisory VDB Entry
https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519a Broken Link
https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228 Broken Link
https://github.com/mazen160/struts-pwn Exploit
https://github.com/rapid7/metasploit-framework/issues/8064 Exploit Issue Tracking
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03733en_us Broken Link
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03749en_us Third Party Advisory
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_us Third Party Advisory
https://isc.sans.edu/diary/22169 Exploit Third Party Advisory
https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E Mailing List
https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html Exploit Third Party Advisory
https://packetstormsecurity.com/files/141494/S2-45-poc.py.txt Exploit Third Party Advisory VDB Entry
https://security.netapp.com/advisory/ntap-20170310-0001/ Third Party Advisory
https://struts.apache.org/docs/s2-045.html Mitigation Vendor Advisory
https://struts.apache.org/docs/s2-046.html Mitigation Vendor Advisory
https://support.lenovo.com/us/en/product_security/len-14200 Third Party Advisory
https://twitter.com/theog150/status/841146956135124993 Broken Link Third Party Advisory
https://www.exploit-db.com/exploits/41614/ Exploit Third Party Advisory VDB Entry
https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/ Third Party Advisory
https://www.kb.cert.org/vuls/id/834067 Third Party Advisory US Government Resource
https://www.symantec.com/security-center/network-protection-security-advisories/SA145 Broken Link

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
sonatype/sonatype-field-workshop

None

Dockerfile Python Java CSS

Updated: 5 days, 14 hours ago
0 stars 0 fork 0 watcher
Born at : Dec. 16, 2024, 4:43 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
Xernary/CVE-2017-5638-POC

Proof of concept of CVE-2017-5638 including the whole setup of the Apache vulnerable server

Dockerfile Java Shell Python

Updated: 1 week, 4 days ago
0 stars 0 fork 0 watcher
Born at : Dec. 8, 2024, 5:22 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
praveenmv-git/dependabotdemo

None

Dockerfile Python Java CSS JavaScript C

Updated: 1 month ago
0 stars 0 fork 0 watcher
Born at : Nov. 20, 2024, 7:06 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
XiaomingX/awesome-poc-for-red-team

A curated collection of Proof of Concept (PoC) tools, scripts, and techniques designed for red team operations, penetration testing, and cybersecurity research. This repository focuses on providing practical resources for exploring vulnerabilities

attack cybersecurity exp hw penetration-testing poc red-team security-tools vulnerability-poc

Updated: 2 weeks, 4 days ago
1 stars 2 fork 2 watcher
Born at : Nov. 17, 2024, 11:53 a.m. This repo has been linked 414 different CVEs too.
Profile Photo
haidersama/nmap-arabic

يركز هذا المستودع على تقديم اساسيات اداة (نماب)باللغة العربية للمبتدئين

Updated: 1 month, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : Nov. 5, 2024, 1:54 p.m. This repo has been linked 2 different CVEs too.
Profile Photo
ExplodingKetchup/SC3010-Struts2-vuln-demo

None

Dockerfile Java HTML

Updated: 1 month ago
0 stars 0 fork 0 watcher
Born at : Oct. 29, 2024, 7:46 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
NAYLINNU/PayloadAllTheThings

None

Python Ruby PHP Shell HTML JavaScript Jupyter Notebook XSLT

Updated: 1 month, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : Oct. 28, 2024, 12:02 p.m. This repo has been linked 15 different CVEs too.
Profile Photo
hacktheworldlive/exploits-guide

None

Updated: 2 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : Sept. 24, 2024, 5:54 p.m. This repo has been linked 2 different CVEs too.
Profile Photo
J1ezds/Vulnerability-Wiki-page

这是一个每天同步Vulnerability-Wiki中docs-base中内容的项目

HTML

Updated: 1 month, 1 week ago
0 stars 0 fork 0 watcher
Born at : Sept. 20, 2024, 3:27 a.m. This repo has been linked 210 different CVEs too.
Profile Photo
kloutkake/CVE-2017-5638-PoC

This repository provides a PoC for CVE-2017-5638, a remote code execution vulnerability in Apache Struts 2, exploitable via a crafted Content-Type HTTP header.

Python

Updated: 3 months, 1 week ago
0 stars 0 fork 0 watcher
Born at : Sept. 4, 2024, 7:59 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
chetflowers/Equifax.Data.Breach.Technical.Analysis.Strategic.Cybersecurity.Recommendations

Equifax Data Breach: Technical Analysis and Strategic Cybersecurity Recommendations

Updated: 3 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : Aug. 27, 2024, 2:41 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
chetflowers/Equifax-Data-Breach-Analysis-and-Cybersecurity-Recommendations

None

Updated: 3 months, 4 weeks ago
0 stars 0 fork 0 watcher
Born at : Aug. 23, 2024, 11:22 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
Nithylesh/web-application-firewall-

This project demonstrates a Web Application Firewall (WAF) simulation using Flask and a vulnerability checker for CVE-2017-5638. The WAF middleware blocks HTTP requests containing specific patterns, and the vulnerability checker tests for and exploits the Apache Struts 2 vulnerability (CVE-2017-5638).

Python

Updated: 2 weeks, 3 days ago
1 stars 0 fork 0 watcher
Born at : July 11, 2024, 3:16 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
ChalkingCode/ExploitedDucks

A super simple Cisa KEV lookup CLI tool leveraging DuckDB

Python

Updated: 4 months, 3 weeks ago
1 stars 0 fork 0 watcher
Born at : July 2, 2024, 7:56 p.m. This repo has been linked 33 different CVEs too.
Profile Photo
Well-Neri/Simulado-L-gica-de-programa-o

None

HTML

Updated: 5 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : June 19, 2024, 11:41 p.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2017-5638 vulnerability anywhere in the article.

  • The Register
Apache issues patches for critical Struts 2 RCE bug

We now know the remote code execution vulnerability in Apache Struts 2 disclosed back in November carries a near-maximum severity rating following the publication of the CVE. According to the National ... Read more

Published Date: Dec 12, 2024 (1 week, 2 days ago)
CVE-2024-53677 CVE-2023-50164 CVE-2017-5638

The following table lists the changes that have been made to the CVE-2017-5638 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html
    Added Reference http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/
    Added Reference http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt
    Added Reference http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html
    Added Reference http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
    Added Reference http://www.securityfocus.com/bid/96729
    Added Reference http://www.securitytracker.com/id/1037973
    Added Reference https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/
    Added Reference https://cwiki.apache.org/confluence/display/WW/S2-045
    Added Reference https://cwiki.apache.org/confluence/display/WW/S2-046
    Added Reference https://exploit-db.com/exploits/41570
    Added Reference https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519a
    Added Reference https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228
    Added Reference https://github.com/mazen160/struts-pwn
    Added Reference https://github.com/rapid7/metasploit-framework/issues/8064
    Added Reference https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03733en_us
    Added Reference https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03749en_us
    Added Reference https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_us
    Added Reference https://isc.sans.edu/diary/22169
    Added Reference https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E
    Added Reference https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E
    Added Reference https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E
    Added Reference https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html
    Added Reference https://packetstormsecurity.com/files/141494/S2-45-poc.py.txt
    Added Reference https://security.netapp.com/advisory/ntap-20170310-0001/
    Added Reference https://struts.apache.org/docs/s2-045.html
    Added Reference https://struts.apache.org/docs/s2-046.html
    Added Reference https://support.lenovo.com/us/en/product_security/len-14200
    Added Reference https://twitter.com/theog150/status/841146956135124993
    Added Reference https://www.exploit-db.com/exploits/41614/
    Added Reference https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/
    Added Reference https://www.kb.cert.org/vuls/id/834067
    Added Reference https://www.symantec.com/security-center/network-protection-security-advisories/SA145
  • Modified Analysis by [email protected]

    Jul. 25, 2024

    Action Type Old Value New Value
    Removed CVSS V3 NIST AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html Technical Description, Third Party Advisory http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html Exploit, Third Party Advisory
    Changed Reference Type http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/ Technical Description, Third Party Advisory http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/ Exploit, Third Party Advisory
    Changed Reference Type http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt No Types Assigned http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt Third Party Advisory
    Changed Reference Type http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html Press/Media Coverage http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html Press/Media Coverage, Third Party Advisory
    Changed Reference Type http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html No Types Assigned http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html Patch, Third Party Advisory
    Changed Reference Type http://www.securityfocus.com/bid/96729 Third Party Advisory, VDB Entry http://www.securityfocus.com/bid/96729 Broken Link, Third Party Advisory, VDB Entry
    Changed Reference Type http://www.securitytracker.com/id/1037973 No Types Assigned http://www.securitytracker.com/id/1037973 Broken Link, Third Party Advisory, VDB Entry
    Changed Reference Type https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/ Press/Media Coverage https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/ Exploit, Press/Media Coverage
    Changed Reference Type https://cwiki.apache.org/confluence/display/WW/S2-046 No Types Assigned https://cwiki.apache.org/confluence/display/WW/S2-046 Mitigation, Vendor Advisory
    Changed Reference Type https://exploit-db.com/exploits/41570 Exploit, VDB Entry https://exploit-db.com/exploits/41570 Exploit, Third Party Advisory, VDB Entry
    Changed Reference Type https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519a No Types Assigned https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519a Broken Link
    Changed Reference Type https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228 No Types Assigned https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228 Broken Link
    Changed Reference Type https://github.com/rapid7/metasploit-framework/issues/8064 Exploit https://github.com/rapid7/metasploit-framework/issues/8064 Exploit, Issue Tracking
    Changed Reference Type https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03733en_us No Types Assigned https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03733en_us Broken Link
    Changed Reference Type https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03749en_us No Types Assigned https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03749en_us Third Party Advisory
    Changed Reference Type https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_us No Types Assigned https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_us Third Party Advisory
    Changed Reference Type https://isc.sans.edu/diary/22169 Technical Description, Third Party Advisory https://isc.sans.edu/diary/22169 Exploit, Third Party Advisory
    Changed Reference Type https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E No Types Assigned https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E Mailing List
    Changed Reference Type https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E No Types Assigned https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E Mailing List
    Changed Reference Type https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E No Types Assigned https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E Mailing List
    Changed Reference Type https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html Third Party Advisory https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html Exploit, Third Party Advisory
    Changed Reference Type https://packetstormsecurity.com/files/141494/S2-45-poc.py.txt Exploit, VDB Entry https://packetstormsecurity.com/files/141494/S2-45-poc.py.txt Exploit, Third Party Advisory, VDB Entry
    Changed Reference Type https://security.netapp.com/advisory/ntap-20170310-0001/ No Types Assigned https://security.netapp.com/advisory/ntap-20170310-0001/ Third Party Advisory
    Changed Reference Type https://struts.apache.org/docs/s2-045.html No Types Assigned https://struts.apache.org/docs/s2-045.html Mitigation, Vendor Advisory
    Changed Reference Type https://struts.apache.org/docs/s2-046.html No Types Assigned https://struts.apache.org/docs/s2-046.html Mitigation, Vendor Advisory
    Changed Reference Type https://support.lenovo.com/us/en/product_security/len-14200 No Types Assigned https://support.lenovo.com/us/en/product_security/len-14200 Third Party Advisory
    Changed Reference Type https://twitter.com/theog150/status/841146956135124993 Third Party Advisory https://twitter.com/theog150/status/841146956135124993 Broken Link, Third Party Advisory
    Changed Reference Type https://www.exploit-db.com/exploits/41614/ No Types Assigned https://www.exploit-db.com/exploits/41614/ Exploit, Third Party Advisory, VDB Entry
    Changed Reference Type https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/ No Types Assigned https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/ Third Party Advisory
    Changed Reference Type https://www.kb.cert.org/vuls/id/834067 No Types Assigned https://www.kb.cert.org/vuls/id/834067 Third Party Advisory, US Government Resource
    Changed Reference Type https://www.symantec.com/security-center/network-protection-security-advisories/SA145 No Types Assigned https://www.symantec.com/security-center/network-protection-security-advisories/SA145 Broken Link
    Removed CWE NIST CWE-20
    Added CWE NIST CWE-755
    Changed CPE Configuration OR *cpe:2.3:a:apache:struts:2.3.5:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.6:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.9:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.10:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.11:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.13:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.17:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.19:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.21:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.22:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.23:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.25:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.26:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.27:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.31:*:*:*:*:*:*:* OR *cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* versions from (including) 2.2.3 up to (excluding) 2.3.32 *cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* versions from (including) 2.5.0 up to (excluding) 2.5.10.1
    Changed CPE Configuration OR *cpe:2.3:a:apache:struts:2.5:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.5.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.5.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.5.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.5.4:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.5.5:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.5.6:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.5.7:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.5.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.5.9:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.5.10:*:*:*:*:*:*:* AND OR *cpe:2.3:o:ibm:storwize_v3500_firmware:7.7.1.6:*:*:*:*:*:*:* *cpe:2.3:o:ibm:storwize_v3500_firmware:7.8.1.0:*:*:*:*:*:*:* OR cpe:2.3:h:ibm:storwize_v3500:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:ibm:storwize_v5000_firmware:7.7.1.6:*:*:*:*:*:*:* *cpe:2.3:o:ibm:storwize_v5000_firmware:7.8.1.0:*:*:*:*:*:*:* OR cpe:2.3:h:ibm:storwize_v5000:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:ibm:storwize_v7000_firmware:7.7.1.6:*:*:*:*:*:*:* *cpe:2.3:o:ibm:storwize_v7000_firmware:7.8.1.0:*:*:*:*:*:*:* OR cpe:2.3:h:ibm:storwize_v7000:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:lenovo:storage_v5030_firmware:7.7.1.6:*:*:*:*:*:*:* *cpe:2.3:o:lenovo:storage_v5030_firmware:7.8.1.0:*:*:*:*:*:*:* OR cpe:2.3:h:lenovo:storage_v5030:-:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:a:hp:server_automation:9.1.0:*:*:*:*:*:*:* *cpe:2.3:a:hp:server_automation:10.0.0:*:*:*:*:*:*:* *cpe:2.3:a:hp:server_automation:10.1.0:*:*:*:*:*:*:* *cpe:2.3:a:hp:server_automation:10.2.0:*:*:*:*:*:*:* *cpe:2.3:a:hp:server_automation:10.5.0:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:weblogic_server:12.2.1.1.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:weblogic_server:12.2.1.2.0:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:* versions up to (excluding) 6.6.5
    Added CPE Configuration OR *cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Nov. 07, 2023

    Action Type Old Value New Value
    Added Reference Apache Software Foundation https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519a [No types assigned]
    Added Reference Apache Software Foundation https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228 [No types assigned]
    Added Reference Apache Software Foundation https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E [No types assigned]
    Added Reference Apache Software Foundation https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E [No types assigned]
    Added Reference Apache Software Foundation https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E [No types assigned]
    Removed Reference Apache Software Foundation https://git1-us-west.apache.org/repos/asf?p=struts.git;a=commit;h=6b8272ce47160036ed120a48345d9aa884477228
    Removed Reference Apache Software Foundation https://git1-us-west.apache.org/repos/asf?p=struts.git;a=commit;h=352306493971e7d5a756d61780d57a76eb1f519a
    Removed Reference Apache Software Foundation https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3Cannounce.apache.org%3E
    Removed Reference Apache Software Foundation https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922@%3Cannounce.apache.org%3E
    Removed Reference Apache Software Foundation https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7@%3Cannounce.apache.org%3E
  • CVE Modified by [email protected]

    Feb. 24, 2021

    Action Type Old Value New Value
    Added Reference https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7@%3Cannounce.apache.org%3E [No Types Assigned]
  • CVE Modified by [email protected]

    Jan. 26, 2021

    Action Type Old Value New Value
    Added Reference https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922@%3Cannounce.apache.org%3E [No Types Assigned]
  • CVE Modified by [email protected]

    Jan. 31, 2020

    Action Type Old Value New Value
    Added Reference https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3Cannounce.apache.org%3E [No Types Assigned]
  • CVE Modified by [email protected]

    Mar. 04, 2018

    Action Type Old Value New Value
    Added Reference http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt [No Types Assigned]
  • CVE Modified by [email protected]

    Nov. 10, 2017

    Action Type Old Value New Value
    Added Reference https://security.netapp.com/advisory/ntap-20170310-0001/ [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 10, 2017

    Action Type Old Value New Value
    Added Reference https://www.kb.cert.org/vuls/id/834067 [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 23, 2017

    Action Type Old Value New Value
    Changed Description The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 mishandles file upload, which allows remote attackers to execute arbitrary commands via a #cmd= string in a crafted Content-Type HTTP header, as exploited in the wild in March 2017. The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
    Added Reference https://struts.apache.org/docs/s2-046.html [No Types Assigned]
    Added Reference https://struts.apache.org/docs/s2-045.html [No Types Assigned]
    Added Reference https://cwiki.apache.org/confluence/display/WW/S2-046 [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 22, 2017

    Action Type Old Value New Value
    Added Reference https://www.symantec.com/security-center/network-protection-security-advisories/SA145 [No Types Assigned]
  • CVE Modified by [email protected]

    Aug. 16, 2017

    Action Type Old Value New Value
    Added Reference https://www.exploit-db.com/exploits/41614/ [No Types Assigned]
  • CVE Modified by [email protected]

    Aug. 09, 2017

    Action Type Old Value New Value
    Added Reference http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html [No Types Assigned]
  • CVE Modified by [email protected]

    Jul. 17, 2017

    Action Type Old Value New Value
    Added Reference http://www.securitytracker.com/id/1037973 [No Types Assigned]
  • CVE Modified by [email protected]

    May. 27, 2017

    Action Type Old Value New Value
    Added Reference https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03749en_us [No Types Assigned]
  • CVE Modified by [email protected]

    May. 10, 2017

    Action Type Old Value New Value
    Added Reference https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_us [No Types Assigned]
    Added Reference https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03733en_us [No Types Assigned]
  • CVE Modified by [email protected]

    Mar. 30, 2017

    Action Type Old Value New Value
    Added Reference https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/ [No Types Assigned]
    Added Reference https://support.lenovo.com/us/en/product_security/len-14200 [No Types Assigned]
  • Reanalysis by [email protected]

    Mar. 27, 2017

    Action Type Old Value New Value
    Changed CVSS V3 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  • Reanalysis by [email protected]

    Mar. 15, 2017

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:a:apache:struts:2.3.10:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.11:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.13:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.17:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.19:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.21:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.22:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.23:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.25:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.26:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.27:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.31:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.32:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.5:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.6:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.9:*:*:*:*:*:*:* OR *cpe:2.3:a:apache:struts:2.3.10:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.11:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.13:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.17:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.19:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.21:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.22:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.23:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.25:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.26:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.27:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.31:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.5:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.6:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.9:*:*:*:*:*:*:*
  • Reanalysis by [email protected]

    Mar. 14, 2017

    Action Type Old Value New Value
    Changed Reference Type https://twitter.com/theog150/status/841146956135124993 No Types Assigned https://twitter.com/theog150/status/841146956135124993 Third Party Advisory
    Changed Reference Type https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/ No Types Assigned https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/ Press/Media Coverage
    Changed Reference Type http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html No Types Assigned http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html Press/Media Coverage
    Changed Reference Type http://www.securityfocus.com/bid/96729 No Types Assigned http://www.securityfocus.com/bid/96729 Third Party Advisory, VDB Entry
  • Initial Analysis by [email protected]

    Mar. 14, 2017

    Action Type Old Value New Value
    Added CVSS V2 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
    Added CVSS V3 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type https://git1-us-west.apache.org/repos/asf?p=struts.git;a=commit;h=6b8272ce47160036ed120a48345d9aa884477228 No Types Assigned https://git1-us-west.apache.org/repos/asf?p=struts.git;a=commit;h=6b8272ce47160036ed120a48345d9aa884477228 Patch
    Changed Reference Type https://packetstormsecurity.com/files/141494/S2-45-poc.py.txt No Types Assigned https://packetstormsecurity.com/files/141494/S2-45-poc.py.txt Exploit, VDB Entry
    Changed Reference Type https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html No Types Assigned https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html Third Party Advisory
    Changed Reference Type https://cwiki.apache.org/confluence/display/WW/S2-045 No Types Assigned https://cwiki.apache.org/confluence/display/WW/S2-045 Mitigation, Vendor Advisory
    Changed Reference Type https://exploit-db.com/exploits/41570 No Types Assigned https://exploit-db.com/exploits/41570 Exploit, VDB Entry
    Changed Reference Type http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html No Types Assigned http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html Technical Description, Third Party Advisory
    Changed Reference Type https://git1-us-west.apache.org/repos/asf?p=struts.git;a=commit;h=352306493971e7d5a756d61780d57a76eb1f519a No Types Assigned https://git1-us-west.apache.org/repos/asf?p=struts.git;a=commit;h=352306493971e7d5a756d61780d57a76eb1f519a Patch
    Changed Reference Type http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/ No Types Assigned http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/ Technical Description, Third Party Advisory
    Changed Reference Type https://github.com/mazen160/struts-pwn No Types Assigned https://github.com/mazen160/struts-pwn Exploit
    Changed Reference Type https://isc.sans.edu/diary/22169 No Types Assigned https://isc.sans.edu/diary/22169 Technical Description, Third Party Advisory
    Changed Reference Type https://github.com/rapid7/metasploit-framework/issues/8064 No Types Assigned https://github.com/rapid7/metasploit-framework/issues/8064 Exploit
    Added CWE CWE-20
    Added CPE Configuration OR *cpe:2.3:a:apache:struts:2.3.10:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.11:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.13:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.17:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.19:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.21:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.22:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.23:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.25:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.26:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.27:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.31:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.32:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.5:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.6:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.9:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:a:apache:struts:2.5:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.5.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.5.10:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.5.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.5.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.5.4:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.5.5:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.5.6:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.5.7:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.5.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.5.9:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Mar. 14, 2017

    Action Type Old Value New Value
    Added Reference https://twitter.com/theog150/status/841146956135124993 [No Types Assigned]
    Added Reference https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/ [No Types Assigned]
    Added Reference http://www.securityfocus.com/bid/96729 [No Types Assigned]
    Added Reference http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html [No Types Assigned]
  • CVE Modified by [email protected]

    Mar. 13, 2017

    Action Type Old Value New Value
    Added Reference https://packetstormsecurity.com/files/141494/S2-45-poc.py.txt [No Types Assigned]
    Added Reference https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html [No Types Assigned]
    Added Reference https://github.com/mazen160/struts-pwn [No Types Assigned]
    Added Reference https://exploit-db.com/exploits/41570 [No Types Assigned]
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2017-5638 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2017-5638 weaknesses.

Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

95.86 }} -0.68%

score

0.99601

percentile

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
: