{"action":"Upgrade org.apache.struts:struts2-core to 2.3.35 (2.3.x) or 2.5.17 (2.5.x) or later.","affected":[{"fixed":"2.3.35","introduced":"2.0.4"},{"fixed":"2.5.17","introduced":"2.5"}],"component":"org.apache.struts:struts2-core","cve_ids":["CVE-2018-11776"],"ecosystem":"Maven","epss":0.99995,"exploited":true,"fixed_versions":["2.3.35","2.5.17"],"ghsa_id":"GHSA-cr6j-3jp9-rw65","id":"tcs_01M5N8T55CRCBASPN6T8E5FS4S","modified_at":"2025-10-22T19:26:43.207029Z","published_at":"2018-10-18T19:24:38Z","references":["https://osv.dev/vulnerability/GHSA-cr6j-3jp9-rw65","https://nvd.nist.gov/vuln/detail/CVE-2018-11776","https://github.com/apache/struts/commit/6e87474f9ad0549f07dd2c37d50a9ccd0977c6e","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.exploit-db.com/exploits/45367","https://www.exploit-db.com/exploits/45262","https://www.exploit-db.com/exploits/45260","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-11776","https://web.archive.org/web/20201208145803/https://securitytracker.com/id/1041547","https://web.archive.org/web/20200807025819/http://www.securitytracker.com/id/1041888","https://web.archive.org/web/20180822160726/http://www.securityfocus.com/bid/105125","https://security.netapp.com/advisory/ntap-20181018-0002","https://security.netapp.com/advisory/ntap-20180822-0001","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0012","https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E","https://lgtm.com/blog/apache_struts_CVE-2018-11776","https://github.com/hook-s3c/CVE-2018-11776-Python-PoC","https://github.com/apache/struts","https://cwiki.apache.org/confluence/display/WW/S2-057","http://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.html","http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txt","http://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/105125","http://www.securitytracker.com/id/1041547","http://www.securitytracker.com/id/1041888"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-cr6j-3jp9-rw65","url":"https://osv.dev/vulnerability/GHSA-cr6j-3jp9-rw65"},{"source":"kev","source_id":"CVE-2018-11776","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}],"summary":"Apache Struts vulnerable to remote command execution (RCE) due to improper input validation"}