CVE-2017-12611

PoC —

CVSS 3.0

9.8 critical

EPSS

87%p100

Published

Sep 20, 2017 (Sep 20, 2017)

Modified

Jun 17, 2026

Description

In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.

Vendors: apache
Products: struts
Weakness: CWE-20
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (87.1%)

In the news4 stories

Top 15 Vulnerabilities Attackers Exploited Millions of Times to Hack Linux Systems

The Hacker NewsAug 23, 13:27 UTC · Aug 23, 2021Vulnerability in the wildCVE-2017-5638 CVE-2017-9805 CVE-2018-7600+12 CVEs

Oracle releases security patches for Apache Struts CVE-2017

Security AffairsSep 26, 06:34 UTC · Sep 26, 2017Vulnerability in the wildCVE-2017-9805 CVE-2017-7672 CVE-2017-9787+5 CVEs

Apache Struts 2 Flaws Affect Multiple Cisco Products

The Hacker NewsSep 12, 10:51 UTC · Sep 12, 2017Data breach in the wildCVE-2017-9805 CVE-2017-5638 CVE-2017-9793+2 CVEs

New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens

The Hacker NewsJul 17, 17:12 UTC · Jul 17, 2026Malware CVE-2026-39987 CVE-2026-41176 CVE-2022-22947+1 CVEs