CVE-2017-12611
Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literal
CVE-2017-12611 is a critical vulnerability (CVSS 9.8) in Apache Struts, published September 20, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 87.1%, the 99th percentile. Fixed in org.apache.struts:struts2-core 2.3.34.
- Severity
- 9.8 CriticalCVSS 3.0, NVD
- Exploit chance
- 87.1%EPSS, 99th percentile
- Exploitation
- None known5 public exploits
- Fixed in
2.3.34org.apache.struts:struts2-core +3 more
Description
In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts:struts2-coreMaven | 2.0.1 to 2.3.33 | 2.3.34 |
org.apache.struts:struts2-coreMaven | 2.5.0 to 2.5.10.1 | 2.5.11 |
org.apache.struts:struts2-coreMaven | 2.0.1 up to 2.3.34, plus listed versions 2.0.112.0.11.12.0.11.22.0.122.0.14 Show 45 moreShow less2.0.52.0.62.0.82.0.92.1.22.1.62.1.82.1.8.12.2.12.2.1.12.2.32.2.3.12.3.12.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.15.22.3.15.32.3.162.3.16.12.3.16.22.3.16.32.3.202.3.20.12.3.20.32.3.242.3.24.12.3.24.32.3.282.3.28.12.3.292.3.32.3.302.3.312.3.322.3.332.3.42.3.4.12.3.7 | 2.3.34 |
org.apache.struts:struts2-coreMaven | 2.5.0 up to 2.5.11, plus listed versions 2.52.5.12.5.102.5.10.12.5.22.5.52.5.8 | 2.5.11 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Struts 2.0.1 < 2.3.33 / 2.5 < 2.5.10 - Arbitrary Code Execution | 2017-09-08 |
| PoC in GitHub | brianwrf/S2-053-CVE-2017-12611 | 2017-09-08 |
| PoC in GitHub | tcetin704/CVE-2017-12611 | 2025-09-15 |
| PoC in GitHub | zeynepsilao/CVE-2017-12611_Exploit | 2025-09-24 |
| Nuclei | Apache Struts2 S2-053 - Remote Code Execution |
What each source reports
NVD Score used
In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
- Record
CVE-2017-12611- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
- Record
CVE-2017-12611- Updated
- 2026-11-02
EUVDEUVD-2018-0550No score
In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
- Record
EUVD-2018-0550- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8fx9-5hx8-crhm
Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literal
In Apache Struts 2.0.1 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
- Record
GHSA-8fx9-5hx8-crhm- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
- Record
CVE-2017-12611- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-8fx9-5hx8-crhm
Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literal
In Apache Struts 2.0.1 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
- Record
GHSA-8fx9-5hx8-crhm- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt
struts.apache.org/docs/s2-053.html
securityfocus.com/bid/100829
kb.netapp.com/support/s/article/ka51A000000CgttQAC/NTAP-20170911-0001
nvd.nist.gov/vuln/detail/CVE-2017-12611
Show 5 moreShow less
Left out here: 1 version. The JSON record has them.