CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2017-5638
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
Severity
- EPSS
- 100% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2021-11-03, due 2022-05-03, known ransomware use
- CWE
- CWE-755
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:struts
- arubanetworks:clearpass_policy_manager
- hp:server_automation
- ibm:storwize_v3500_firmware
- ibm:storwize_v5000_firmware
- ibm:storwize_v7000_firmware
- lenovo:storage_v5030_firmware
- netapp:oncommand_balance
- oracle:weblogic_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-j77q-2qqg-6989 | Maven | org.apache.struts:struts2-core | >=2.3.0 <2.3.32 | 2.3.32 |
| GHSA-j77q-2qqg-6989 | Maven | org.apache.struts:struts2-core | >=2.5.0 <2.5.10.1 | 2.5.10.1 |
References
- http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html
- http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt
- http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html