Every CVE Search/ Get API key

CVE-2017-5638

Apache Struts vulnerable to remote arbitrary command execution due to improper input validation

9.8 CriticalIn KEVPublic exploitFix available

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

100.0%Up 5.9 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Record
CVE-2017-5638
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-755
Updated
2026-11-02
CVE List 9.8

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Record
CVE-2017-5638
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-755
Updated
2026-11-02
EUVDEUVD-2018-0625 9.8

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Record
EUVD-2018-0625
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-j77q-2qqg-6989 10.0

Apache Struts vulnerable to remote arbitrary command execution due to improper input validation

Apache Struts versions prior to 2.3.32 and 2.5.10.1 contain incorrect exception handling and error-message generation during file-upload attempts using the Jakarta Multipart parser, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Record
GHSA-j77q-2qqg-6989
CVSS 3.0
10.0 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
Weakness
CWE-20, CWE-755
Updated
2026-11-02
CISA KEV No score

Apache Struts Remote Code Execution Vulnerability

Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.

Record
CVE-2017-5638
Weakness
CWE-20
Updated
2026-11-02
OSV 9.8

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Record
CVE-2017-5638
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-j77q-2qqg-6989 10.0

Apache Struts vulnerable to remote arbitrary command execution due to improper input validation

Apache Struts versions prior to 2.3.32 and 2.5.10.1 contain incorrect exception handling and error-message generation during file-upload attempts using the Jakarta Multipart parser, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Record
GHSA-j77q-2qqg-6989
CVSS 3.0
10.0 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
Weakness
CWE-20, CWE-755
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.struts:struts2-core
Maven
 2.3.0 to 2.3.31
2.3.32
org.apache.struts:struts2-core
Maven
 2.5.0 to 2.5.10
2.5.10.1
org.apache.struts:struts2-core
Maven
 2.3.0 up to 2.3.32, plus listed versions
2.3.12.3.1.12.3.1.22.3.122.3.14
Show 27 moreShow less
2.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.15.22.3.15.32.3.162.3.16.12.3.16.22.3.16.32.3.202.3.20.12.3.20.32.3.242.3.24.12.3.24.32.3.282.3.28.12.3.292.3.32.3.302.3.312.3.42.3.4.12.3.72.3.8
2.3.32
org.apache.struts:struts2-core
Maven
 2.5.0 up to 2.5.10.1, plus listed versions
2.52.5.12.5.102.5.22.5.52.5.8
2.5.10.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBApache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - Remote Code Execution2017-03-07
PoC in GitHubFlyteas/Struts2-045-Exp2017-03-07
PoC in GitHubPolarisLab/S2-0452017-03-07
MetasploitApache Struts Jakarta Multipart Parser OGNL Injection2017-03-07
PoC in GitHubbongbongco/cve-2017-56382017-03-08
PoC in GitHubjas502n/S2-045-EXP-POC-TOOLS2017-03-09
PoC in GitHubbtamburi/strutszeiro2017-03-10
PoC in GitHubimmunio/apache-struts2-CVE-2017-56382017-03-10
PoC in GitHubxsscx/cve-2017-56382017-03-10
PoC in GitHubMasahiro-Yamada/OgnlContentTypeRejectorValve2017-03-11
Show 19 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubaljazceru/CVE-2017-5638-Apache-Struts22017-03-11
PoC in GitHubinitconf/CVE-2017-5638_struts2017-03-11
PoC in GitHubjrrombaldo/CVE-2017-56382017-03-11
PoC in GitHubrandom-robbie/CVE-2017-56382017-03-11
PoC in GitHubsjitech/test_struts2_vulnerability_CVE-2017-56382017-03-11
PoC in GitHublolwaleet/ExpStruts2017-03-12
PoC in GitHubmazen160/struts-pwn2017-03-12
PoC in GitHubret2jazzy/Struts-Apache-ExploitPack2017-03-12
PoC in GitHuboktavianto/CVE-2017-5638-Apache-Struts22017-03-13
Exploit-DBApache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - 'Jakarta' Multipart Parser OGNL Injection (Metasploit)2017-03-15
PoC in GitHubjrrdev/cve-2017-56382017-03-15
PoC in GitHubopt9/Strutshock2017-03-16
PoC in GitHubfalcon-lnhg/StrutsShell2017-03-17
PoC in GitHubKarzsGHR/S2-046_S2-045_POC2017-03-21
PoC in GitHubjas502n/st2-046-poc2017-03-21
PoC in GitHubgsfish/S2-Reaper2017-03-23
PoC in GitHubmcassano/cve-2017-56382017-03-26
PoC in GitHubopt9/Strutscli2017-03-28
NucleiApache Struts 2 - Remote Command Execution

Plus 62 more. The full list has every link.

History

History
RecordedChangedSources
exploitation
exploits, exploits_more
exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-5638 is a critical vulnerability (CVSS 9.8) in Apache Struts, published March 11, 2017. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. Fixed in org.apache.struts:struts2-core 2.3.32.

References

Show 40 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open