CVE-2018-11776
HIGHCVSS 8.1/10Actively ExploitedEPSS 99.99%
Last modified
CVE-2018-11776 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.. CISA has confirmed active exploitation in the wild. EPSS estimates a 99.99% chance of exploitation in the next 30 days.
Description
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Struts | >= 2.0.4, < 2.3.35 |
| Apache | Struts | >= 2.5.0, < 2.5.17 |
| Netapp | Active Iq Unified Manager | >= 7.3 |
| Netapp | Active Iq Unified Manager | >= 9.5 |
| Netapp | Oncommand Insight | All versions |
| Netapp | Oncommand Workflow Automation | All versions |
| Netapp | Snapcenter | All versions |
| Oracle | Communications Policy Management | < 12.5.0 |
| Oracle | Enterprise Manager Base Platform | 13.3.0.0 |
| Oracle | Enterprise Manager Base Platform | 13.4.0.0 |
| Oracle | Mysql Enterprise Monitor | <= 3.4.9.4237 |
| Oracle | Mysql Enterprise Monitor | >= 4.0.0, <= 4.0.6.5281 |
| Oracle | Mysql Enterprise Monitor | >= 8.0.0, <= 8.0.2.8191 |
References
- http://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txtBroken Link, Mailing List, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787.htmlPatch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlPatch, Third Party Advisory
- http://www.securityfocus.com/bid/105125Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041547Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041888Broken Link, Third Party Advisory, VDB Entry
- https://cwiki.apache.org/confluence/display/WW/S2-057Issue Tracking, Third Party Advisory
- https://github.com/hook-s3c/CVE-2018-11776-Python-PoCExploit, Third Party Advisory
- https://lgtm.com/blog/apache_struts_CVE-2018-11776Exploit, Third Party Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0012Third Party Advisory
- https://security.netapp.com/advisory/ntap-20180822-0001/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20181018-0002/Third Party Advisory
- https://www.exploit-db.com/exploits/45260/Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/45262/Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/45367/Exploit, Third Party Advisory, VDB Entry
- https://www.oracle.com/security-alerts/cpujul2020.htmlThird Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlPatch, Third Party Advisory
- http://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txtBroken Link, Mailing List, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787.htmlPatch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlPatch, Third Party Advisory
- http://www.securityfocus.com/bid/105125Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041547Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041888Broken Link, Third Party Advisory, VDB Entry
- https://cwiki.apache.org/confluence/display/WW/S2-057Issue Tracking, Third Party Advisory
- https://github.com/hook-s3c/CVE-2018-11776-Python-PoCExploit, Third Party Advisory
- https://lgtm.com/blog/apache_struts_CVE-2018-11776Exploit, Third Party Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0012Third Party Advisory
- https://security.netapp.com/advisory/ntap-20180822-0001/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20181018-0002/Third Party Advisory
- https://www.exploit-db.com/exploits/45260/Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/45262/Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/45367/Exploit, Third Party Advisory, VDB Entry
- https://www.oracle.com/security-alerts/cpujul2020.htmlThird Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlPatch, Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-11776US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2018-11776?
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
How severe is CVE-2018-11776?
CVE-2018-11776 has a CVSS score of 8.1/10 (HIGH severity). The EPSS model estimates a 99.99% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
How do I fix CVE-2018-11776?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-11770From version 1.3.0 onward, Apache Spark's standalone master …4.2
- CVE-2018-11771When reading a specially crafted ZIP archive, the read metho…5.5
- CVE-2018-11772Apache VCL versions 2.1 through 2.5 do not properly validate…
- CVE-2018-11773Apache VCL versions 2.1 through 2.5 do not properly validate…
- CVE-2018-11774Apache VCL versions 2.1 through 2.5 do not properly validate…
- CVE-2018-11775TLS hostname verification when using the Apache ActiveMQ Cli…
- CVE-2018-11777In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on …
- CVE-2018-11778UnixAuthenticationService in Apache Ranger 1.2.0 was updated…
- CVE-2018-11779In Apache Storm versions 1.1.0 to 1.2.2, when the user is us…
- CVE-2018-1178This vulnerability allows remote attackers to execute arbitr…
- CVE-2018-11780A potential Remote Code Execution bug exists with the PDFInf…
- CVE-2018-11781Apache SpamAssassin 3.4.2 fixes a local user code injection …
Are you affected by CVE-2018-11776?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST