CVE-2017-12611 Apache Struts
| Affected software | Apache Struts |
|---|---|
| Severity | 9.8 Critical CVSS 3.0 2 scores |
| Fixed in | 2.3.34, 2.5.11 |
| Weakness | Improper input validation (CWE-20) |
| Published | 20 Sep 2017 |
| Updated | 13 Nov 2026 |
Description
In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
Exploitation status
Exploited
Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV listed Exploitation reported in the wild. 2 citations · 3 exploits · earliest 2024-04-15.
- CISA Vulnrichment no assessment published
- Indexed PoC 4 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Nuclei; first seen 2017-09-08.
- EPSS 87% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.8% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2017-12611 in VulnCheck (free account).
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Reported exploitation | veriti.ai | /blog/vulnerable-villain-when-hackers-get-hacked | 2024-04-15 |
| Reported exploitation | ti.qianxin.com | /blog/articles/operation-run-the-cyber-carnival-of-offshore-patriots-en | 2025-05-19 |
| Exploit reference | VulnCheck XDB c0c7a67b1662 | Exploit type: initial-access | 2017-09-08 |
| Exploit reference | VulnCheck XDB 8fda6a527fab | Exploit type: initial-access | 2025-09-15 |
| Exploit reference | VulnCheck XDB 102671f49f40 | Exploit type: initial-access | 2025-09-24 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | A simple script for exploit RCE for Struts 2 S2-053(CVE-2017-12611) | 37 | 2017-09-08 |
| GitHub PoC | RCE project | 2025-09-24 | |
| Exploit-DB | Apache Struts 2.0.1 < 2.3.33 / 2.5 < 2.5.10 - Arbitrary Code Execution | 2017-09-08 | |
| Nuclei | Apache Struts2 S2-053 - Remote Code Execution |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Process
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the ARMR Process rule. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: ARMR Process rule
Exploitation forks a process. Blocked by the Process rule in PROTECT mode.
Only stops attacks that start a program; an expression that reads files or data directly in Java is not stopped.
The payload invokes an absolute interpreter path, so the rule has to cover it; a scope limited to upload and temp directories will not match.
How to mitigate CVE-2017-12611
Upgrade Apache Struts to a release that fixes it: 2.3.34 or 2.5.11. Until you can, Waratek RASP blocks exploitation with its process rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
9.8 CRITICAL
v3.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
CVSS
9.8 CRITICAL v3.0CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.0 | 9.8 | CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 2.0 | 7.5 | none | AV:N/AC:L/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.struts:struts2-core |
2.0.1 | 2.3.34 |
unbounded |
org.apache.struts:struts2-core |
2.5.0 | 2.5.11 |
unbounded |
Products and versions
2 products, 92 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | struts | generic | 2.0.1 · 2.0.2 · 2.0.3 · 2.0.4 · 2.0.5 · 2.0.6 · 2.0.7 · 2.0.8 · 2.0.9 · 2.0.10 · 2.0.11 · 2.0.11.1 · 2.0.11.2 · 2.0.12 · 2.0.13 · 2.0.14 · 2.1.0 · 2.1.1 · 2.1.2 · 2.1.3 · 2.1.4 · 2.1.5 · 2.1.6 · 2.1.8 · 2.1.8.1 · 2.2.1 · 2.2.1.1 · 2.2.3 · 2.2.3.1 · 2.3.1 · 2.3.1.1 · 2.3.1.2 · 2.3.3 · 2.3.4 · 2.3.4.1 · 2.3.5 · 2.3.6 · 2.3.7 · 2.3.8 · 2.3.9 · 2.3.10 · 2.3.11 · 2.3.12 · 2.3.13 · 2.3.14 · 2.3.14.1 · 2.3.14.2 · 2.3.14.3 · 2.3.15 · 2.3.15.1 · 2.3.15.2 · 2.3.15.3 · 2.3.16 · 2.3.16.1 · 2.3.16.2 · 2.3.16.3 · 2.3.17 · 2.3.19 · 2.3.20 · 2.3.20.1 · 2.3.20.2 · 2.3.21 · 2.3.22 · 2.3.23 · 2.3.24.2 · 2.3.24.3 · 2.3.25 · 2.3.26 · 2.3.27 · 2.3.28 · 2.3.28.1 · 2.3.29 · 2.3.30 · 2.3.31 · 2.3.32 · 2.3.33 · 2.5 · 2.5:beta1 · 2.5:beta2 · 2.5:beta3 · 2.5.1 · 2.5.2 · 2.5.3 · 2.5.4 · 2.5.5 · 2.5.6 · 2.5.7 · 2.5.8 · 2.5.9 · 2.5.10 |
| osv | org.apache.struts | struts2-core | generic | ≥ 2.0.1 and ＜ 2.3.34 · ≥ 2.5.0 and ＜ 2.5.11 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Products:** STRUTS, APACHE STRUTS 2
References
Timeline
Timeline
| Published | 2017-09-20 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2024-04-15 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| VulnCheck KEV: latest evidence | 2025-09-24 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |
| Last VRT activity | 2026-11-13 | Most recent commit touching this CVE's classification, patch or rule file. |