{"action":"Upgrade org.apache.struts:struts2-core to 2.3.34 (2.3.x) or 2.5.11 (2.5.x) or later.","affected":[{"fixed":"2.3.34","introduced":"2.0.1"},{"fixed":"2.5.11","introduced":"2.5.0"}],"component":"org.apache.struts:struts2-core","cve_ids":["CVE-2017-12611"],"ecosystem":"Maven","epss":0.87123,"exploited":false,"fixed_versions":["2.3.34","2.5.11"],"ghsa_id":"GHSA-8fx9-5hx8-crhm","id":"tcs_01M5N8MK4XY7BSW7MV1E8V97EV","modified_at":"2024-02-16T08:18:45.285811Z","published_at":"2018-10-16T19:35:40Z","references":["https://osv.dev/vulnerability/GHSA-8fx9-5hx8-crhm","https://nvd.nist.gov/vuln/detail/CVE-2017-12611","https://github.com/apache/struts/commit/2306f5f7fad7f0157f216f34331238feb0539fa","https://github.com/apache/struts/commit/637ad1c3707266c33daabb18d7754e795e6681f","https://github.com/apache/struts","https://kb.netapp.com/support/s/article/ka51A000000CgttQAC/NTAP-20170911-0001","https://struts.apache.org/docs/s2-053.html","https://web.archive.org/web/20170923161654/http://www.securityfocus.com/bid/100829","http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt","http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-8fx9-5hx8-crhm","url":"https://osv.dev/vulnerability/GHSA-8fx9-5hx8-crhm"}],"summary":"Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literal"}