Every CVE Search/ Get API key

CVE-2018-11776

Apache Struts vulnerable to remote command execution (RCE) due to improper input validation

8.1 HighIn KEVPublic exploitFix available

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

100.0%Up 10.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.1

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.

Record
CVE-2018-11776
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Updated
2026-11-02
CVE List 8.1

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.

Record
CVE-2018-11776
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
EUVDEUVD-2018-0582 8.1

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.

Record
EUVD-2018-0582
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-cr6j-3jp9-rw65 8.1

Apache Struts vulnerable to remote command execution (RCE) due to improper input validation

Apache Struts contains a Remote Code Execution when using results with no namespace and it's upper actions have no or wildcard namespace. The same flaw exists when using a url tag with no value, action set, and it's upper actions have no or wildcard namespace.

Record
GHSA-cr6j-3jp9-rw65
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-20
Updated
2026-11-02
CISA KEV No score

Apache Struts Remote Code Execution Vulnerability

Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace. Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.

Record
CVE-2018-11776
Weakness
CWE-20
Updated
2026-11-02
OSV 8.1

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.

Record
CVE-2018-11776
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-cr6j-3jp9-rw65 8.1

Apache Struts vulnerable to remote command execution (RCE) due to improper input validation

Apache Struts contains a Remote Code Execution when using results with no namespace and it's upper actions have no or wildcard namespace. The same flaw exists when using a url tag with no value, action set, and it's upper actions have no or wildcard namespace.

Record
GHSA-cr6j-3jp9-rw65
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-20
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.struts:struts2-core
Maven
 2.0.4 to 2.3.34
2.3.35
org.apache.struts:struts2-core
Maven
 2.5 to 2.5.16
2.5.17
org.apache.struts:struts2-core
Maven
 2.0.4 up to 2.3.35, plus listed versions
2.0.112.0.11.12.0.11.22.0.122.0.14
Show 45 moreShow less
2.0.52.0.62.0.82.0.92.1.22.1.62.1.82.1.8.12.2.12.2.1.12.2.32.2.3.12.3.12.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.15.22.3.15.32.3.162.3.16.12.3.16.22.3.16.32.3.202.3.20.12.3.20.32.3.242.3.24.12.3.24.32.3.282.3.28.12.3.292.3.32.3.302.3.312.3.322.3.332.3.342.3.42.3.4.1
2.3.35
org.apache.struts:struts2-core
Maven
 2.5 up to 2.5.17, plus listed versions
2.5.12.5.102.5.10.12.5.122.5.13
Show 6 moreShow less
2.5.142.5.14.12.5.162.5.22.5.52.5.8
2.5.17

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitApache Struts 2 Namespace Redirect OGNL Injection2018-08-22
PoC in GitHubxfox64x/CVE-2018-117762018-08-23
PoC in GitHubhook-s3c/CVE-2018-11776-Python-PoC2018-08-24
PoC in GitHubjiguangsdf/CVE-2018-117762018-08-24
Exploit-DBApache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (2)2018-08-25
PoC in GitHubbhdresh/CVE-2018-117762018-08-25
PoC in GitHubknqyf263/CVE-2018-117762018-08-25
PoC in GitHubmazen160/struts-pwn_CVE-2018-117762018-08-25
Exploit-DBApache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (1)2018-08-26
PoC in GitHubEkultek/Strutter2018-08-27
Show 12 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubbrianwrf/S2-057-CVE-2018-117762018-08-28
PoC in GitHubtuxotron/cve-2018-11776-docker2018-08-28
PoC in GitHub649/Apache-Struts-Shodan-Exploit2018-08-29
Exploit-DBApache Struts 2 - Namespace Redirect OGNL Injection (Metasploit)2018-09-10
PoC in GitHubcved-sources/cve-2018-117762019-01-06
PoC in GitHubOzNetNerd/apche-struts-vuln-demo-cve-2018-117762019-06-24
PoC in GitHubcucadili/CVE-2018-117762019-10-08
PoC in GitHubarlyone/Apache-Struts-0Day-Exploit2019-10-10
PoC in GitHubfreshdemo/ApacheStruts-CVE-2018-117762020-06-12
PoC in GitHubsonpt-afk/CVE-2018-11776-FIS2023-06-21
PoC in GitHubm4sk0ff/CVE-2018-117762025-09-09
NucleiApache Struts2 S2-057 - Remote Code Execution

History

History
RecordedChangedSources
exploitation, exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-11776 is a high vulnerability (CVSS 8.1) in Apache Struts, published August 22, 2018. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. Fixed in org.apache.struts:struts2-core 2.3.35.

References

Show 22 moreShow less
This page doesn't list everything

Left out here: 2 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open