Assessment
Why it matters
CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 100.0%; technical severity is CVSS 8.1.
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
Who should care
- Teams operating Struts, Active Iq Unified Manager, Oncommand Insight +5 more
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether Struts, Active Iq Unified Manager, Oncommand Insight +5 more is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- Oracle Security patch CVE-2018-11776
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Treatment intelligence
Remediation intelligence
Vendor sources are listed before government and third-party guidance. Confirm product applicability and change prerequisites before deployment.
Patch
Technical details
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-20
- Affected versions
- Apache Struts (Start Including 2.0.4, End Excluding 2.3.35 | Start Including 2.5.0, End Excluding 2.5.17); Netapp Active Iq Unified Manager (Start Including 7.3 | Start Including 9.5); Netapp Oncommand Insight (Version -); Netapp Oncommand Workflow Automation (Version -); Netapp Snapcenter (Version -); Oracle Communications Policy Management (End Excluding 12.5.0); Oracle Enterprise Manager Base Platform (Version 13.3.0.0 | Version 13.4.0.0); Oracle Mysql Enterprise Monitor (End Including 3.4.9.4237 | Start Including 4.0.0, End Including 4.0.6.5281 | Start Including 8.0.0, End Including 8.0.2.8191)
- Fixed versions
- Apache Struts (Fixed from 2.3.35, 2.5.17); Oracle Communications Policy Management (Fixed from 12.5.0)
- Published
- 22 August 2018
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
Signal timeline
- CVE published
- Added to CISA KEV
- Latest EPSS score: 100.0%
- Signal calculated at 83
External references
- SonicWall Third-party advisory SNWLID 2018 0012
- Oracle Third-party advisory Cpujul2020
- CISA Government advisory CVE-2018-11776
- Exploit information from github.com
- Packetstormsecurity Third-party advisory Apache Struts Remote Code Execution
- Arubanetworks Third-party advisory ARUBA PSA 2018 005.txt
- Securityfocus Third-party advisory 105125
- Securitytracker Third-party advisory 1041547
- Securitytracker Third-party advisory 1041888
- Cwiki Apache Third-party advisory S2 057
- Exploit information from lgtm.com
- Lists Apache Technical reference