Lucene search
GoogleOSV:GHSA-8FX9-5HX8-CRHMHistoryOct 16, 2018 - 7:35 p.m.
Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literal
2018-10-1619:35:40
Google
osv.dev
30
In Apache Struts 2.0.1 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
References
www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt
www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
github.com/apache/struts
github.com/apache/struts/commit/2306f5f7fad7f0157f216f34331238feb0539fa
github.com/apache/struts/commit/637ad1c3707266c33daabb18d7754e795e6681f
kb.netapp.com/support/s/article/ka51A000000CgttQAC/NTAP-20170911-0001
nvd.nist.gov/vuln/detail/CVE-2017-12611
struts.apache.org/docs/s2-053.html
web.archive.org/web/20170923161654/www.securityfocus.com/bid/100829
Related
nuclei
nuclei
Apache Struts2 S2-053 - Remote Code Execution
2021-02-21 14:01:50
Apache Struts2 S2-052 - Remote Code Execution
2021-02-21 14:01:07
Apache Struts2 S2-053 - Remote Code Execution
2021-02-21 15:39:29
osv
osv
CVE-2017-12611
2017-09-20 17:29:00
REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering
2018-10-16 19:37:56
CVE-2017-9805
2017-09-15 19:29:00
impervablog
impervablog
Apache Struts, RCE and Managing App Risk
2017-09-18 20:33:25
RedisWannaMine Unveiled: New Cryptojacking Attack Powered by Redis and NSA Exploits
2018-03-08 18:45:38
How Reputation Intelligence Improves Application Security
2017-11-13 16:30:38
checkpoint_advisories
checkpoint_advisories
Apache Struts2 Freemarker Remote Code Execution (CVE-2017-12611) - Ver2
2018-04-15 00:00:00
Apache Struts2 Freemarker Remote Code Execution (CVE-2017-12611)
2017-09-08 00:00:00
ibm
ibm
prion
prion
Code injection
2017-09-20 17:29:00
Deserialization of untrusted data
2017-09-15 19:29:00
nessus
nessus
Apache Struts 2.1.x >= 2.1.2 / 2.2.x / 2.3.x < 2.3.34 / 2.5.x < 2.5.13 Multiple Vulnerabilities (S2-050 - S2-053)
2017-09-05 00:00:00
Apache Struts 2 REST Plugin XStream XML Request Deserialization RCE
2017-09-06 00:00:00
Oracle WebLogic Server Multiple Vulnerabilities
2017-10-04 00:00:00
redhatcve
redhatcve
CVE-2017-12611
2017-09-07 14:48:25
CVE-2017-9805
2017-09-05 14:19:21
openvas
openvas
Apache Struts Security Update (S2-053) - Active Check
2017-09-11 00:00:00
Apache Struts Security Update (S2-053) - Version Check
2021-04-06 00:00:00
Apache Struts Security Update (S2-052) - Active Check
2017-09-07 00:00:00
cve
cve
CVE-2017-12611
2017-09-20 17:29:00
CVE-2017-9805
2017-09-15 19:29:00
seebug
seebug
Apache Struts2 S2-053 (CVE-2017-12611)
2017-09-07 00:00:00
Apache Struts2 S2-052 (CVE-2017-9805)
2017-09-06 00:00:00
cisco
cisco
atlassian
atlassian
dsquare
dsquare
Apache Struts 2 Freemarker Tag Handling RCE
2018-10-20 00:00:00
Apache Struts REST Plugin XStream RCE
2018-04-20 00:00:00
ubuntucve
ubuntucve
CVE-2017-12611
2017-09-20 00:00:00
CVE-2017-9805
2017-09-15 00:00:00
veracode
veracode
Remote Code Execution (RCE)
2017-09-08 06:31:48
zdt
zdt
Apache Struts 2.5 - Remote Code Execution Exploit
2017-09-07 00:00:00
nvd
nvd
CVE-2017-12611
2017-09-20 17:29:00
CVE-2017-9805
2017-09-15 19:29:00
f5
f5
K45474286 : Apache Struts Freemarker Remote Code Execution vulnerability CVE-2017-12611
2017-09-08 00:00:00
K84144321 : Apache Struts vulnerability CVE-2017-9805
2017-09-06 00:00:00
cvelist
cvelist
CVE-2017-12611
2017-09-07 00:00:00
CVE-2017-9805
2017-09-15 19:00:00
github
github
thn
thn
Apache Struts 2 Flaws Affect Multiple Cisco Products
2017-09-11 23:50:00
Critical Flaw in Apache Struts2 Lets Hackers Take Over Web Servers
2017-09-05 07:40:00
Equifax Suffered Data Breach After It Failed to Patch Old Apache Struts Flaw
2017-09-13 21:38:00
cisa
cisa
Oracle Patches Apache Vulnerabilities
2017-09-25 00:00:00
trendmicroblog
trendmicroblog
packetstorm
packetstorm
Apache Struts 2 REST Plugin XStream Remote Code Execution
2017-09-07 00:00:00
Apache Struts 2.5.12 XStream Remote Code Execution
2017-09-07 00:00:00
cert
cert
exploitpack
exploitpack
Apache Struts 2.5 2.5.12 - REST Plugin XStream Remote Code Execution
2017-09-06 00:00:00
saint
saint
Apache Struts REST plugin XStream deserialization vulnerability
2017-09-08 00:00:00
Apache Struts REST plugin XStream deserialization vulnerability
2017-09-08 00:00:00
Apache Struts REST plugin XStream deserialization vulnerability
2017-09-08 00:00:00
cisa_kev
cisa_kev
Apache Struts Deserialization of Untrusted Data Vulnerability
2021-11-03 00:00:00
myhack58
myhack58
metasploit
metasploit
Apache Struts 2 REST Plugin XStream RCE
2017-09-08 00:30:48
attackerkb
attackerkb
CVE-2017-9805
2017-09-15 00:00:00
CVE-2017-9791
2017-07-10 00:00:00
cloudfoundry
cloudfoundry
CVE-2017-9805: Apache Struts Remote Code Execution | Cloud Foundry
2017-09-08 00:00:00
exploitdb
exploitdb
Apache Struts 2.5 < 2.5.12 - REST Plugin XStream Remote Code Execution
2017-09-06 00:00:00
talosblog
talosblog
Another Apache Struts Vulnerability Under Active Exploitation
2017-09-07 15:42:00
2018 in Snort Rules
2019-02-06 08:19:00
threatpost
threatpost
Patch Released for Critical Apache Struts Bug
2017-09-05 14:10:54
Apache Foundation Refutes Involvement in Equifax Breach
2017-09-11 15:02:31
Apache Struts 2 Flaw Uncovered: ‘More Critical Than Equifax Bug’
2018-08-23 16:46:57
pentestit
pentestit
S2-052: Apache Struts2 REST Plugin Payloads (CVE-2017-9805)
2017-09-07 05:33:35
fortinet
fortinet
Apache Struts RCE Vulnerability
2017-09-29 00:00:00
kitploit
kitploit
Sn1per v5.0 - Automated Pentest Recon Scanner
2018-07-05 13:45:00
Sn1per v6.0 - Automated Pentest Framework For Offensive Security Experts
2018-11-24 12:43:00
Sn1per v7.0 - Automated Pentest Framework For Offensive Security Experts
2019-05-12 13:09:00
qualysblog
qualysblog
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR
2022-02-23 05:39:00
oracle
oracle
Oracle Critical Patch Update - October 2017
2017-10-17 00:00:00