Vulnerabilitycritical

Potential Apache Struts 2 RCE flaw fixed, PoCs released

Help Net Securityby @zeljkazorzAug 17, 2020 · 00:00 UTC (Aug 17, 2020)2 min read4 · 1 read

Read at helpnetsecurity.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2019-0230 CVE-2019-0233 CVE-2018-11776 CVE-2017-5638

Tags: cve-2019-0230 cve-2019-0233 cve-2018-11776 cve-2017-5638 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2017-5638	Unauthenticated RCE in Apache Struts Jakarta Multipart parser	9.8	100%	KEVRansomwarePoC ×10	Mar 11, 2017 KEV Nov 3, 2021
CVE-2018-11776	Apache Struts Remote Code Execution via Missing or Wildcard Namespace	8.1	100%	KEVPoC ×5	Aug 22, 2018 KEV Nov 3, 2021
CVE-2019-0230 +1 related CVE CVE-2019-0233	Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution	9.8 group max	97%	PoC ×2	Sep 14, 2020

From the original article

2 min read at helpnetsecurity.com

Have you already updated your Apache Struts 2 to version 2. 5. 22, released in November 2019?

Help Net Security

By @zeljkazorz · helpnetsecurity.com

Read the full article at Help Net Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.