WaratekVRT Sign in

CVE-2018-11776 Apache Struts

Affected softwareApache Struts
Severity8.1 High CVSS 3.1 3 scores
Fixed in2.3.35, 2.5.17
WeaknessImproper input validation (CWE-20)
Published22 Aug 2018
Updated13 Nov 2026

Description

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2021-11-03 · remediation due 2022-05-03 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 9 citations · 20 exploits · earliest 2018-12-18.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: no, technical impact: total.
  • Indexed PoC 21 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2018-08-23.
  • EPSS 99.9% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2018-11776 in VulnCheck (free account), which lists 4 more citations and 15 more exploit references not shown here.

EvidenceSourceDetailDate
Reported exploitation blog.talosintelligence.com /2018/12/cryptomining-campaigns-2018.html 2018-12-18
Reported exploitation lacework.com /blog/elf-of-the-month-new-lucky-ransomware-sample 2019-01-08
Reported exploitation blogs.juniper.net /en-us/threat-research/satan-ransomware-used-in-multi-platform-cryptomining-and-ransomware-campaign 2019-06-15
Reported exploitation web.archive.org /web/20220227045141/https://risksense.com/wp-content/uploads/2019/09/RiskSense-Spotlight-Report-Ransomware.pdf 2019-09-01
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2021-11-03
Exploit reference VulnCheck XDB 3c27e7312b41 Exploit type: initial-access 2018-08-23
Exploit reference VulnCheck XDB 9047aecb9a46 Exploit type: initial-access 2018-08-24
Exploit reference VulnCheck XDB df6d7ff7d1ec Exploit type: initial-access 2018-08-24
Exploit reference VulnCheck XDB 8b73fc205202 Exploit type: initial-access 2018-08-25
Exploit reference VulnCheck XDB 306db2bfde48 Exploit type: initial-access 2018-08-27
IndexArtifactStarsFirst seen
GitHub PoC An exploit for Apache Struts CVE-2018-11776 304 2018-08-25
Nuclei Apache Struts2 S2-057 - Remote Code Execution
Exploit-DB Apache Struts 2 - Namespace Redirect OGNL Injection (Metasploit) 2018-09-10
Metasploit Apache Struts 2 Namespace Redirect OGNL Injection (excellent rank)
GitHub PoC Working Python test and PoC for CVE-2018-11776, includes Docker lab 123 2018-08-24
Exploit-DB Apache Struts 2 - Namespace Redirect OGNL Injection (Metasploit) 2018-09-10
GitHub PoC This tool takes advantage of CVE-2018-11776 and Shodan to perform mass exploitation of verified and vulnerable Apache Struts servers. 56 2018-08-29
Exploit-DB Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (1) 2018-08-26
GitHub PoC Proof of Concept for CVE-2018-11776 21 2018-08-27
Exploit-DB Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (2) 2018-08-25

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR Process rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: ARMR Process rule

Exploitation forks a process. Blocked by the Process rule in PROTECT mode.

Only stops attacks that start a program; an expression that reads files or data directly in Java is not stopped.

How to mitigate CVE-2018-11776

Upgrade Apache Struts to a release that fixes it: 2.3.35 or 2.5.17. Until you can, Waratek RASP blocks exploitation with its process rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

8.1 HIGH v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 8.1 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 8.1 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 9.3 none AV:N/AC:M/Au:N/C:C/I:C/A:C NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2020 ↗ CPU 2020-Q3 Oracle Enterprise Manager / Reporting Framework (Apache Struts 2) (13.3.0.0, 13.4.0.0)
Oracle Critical Patch Update January 2019 ↗ CPU 2019-Q1 Oracle Communications Applications / Security (Apache Struts 2) (prior to 12.5)
Oracle Critical Patch Update October 2018 ↗ CPU 2018-Q4 Oracle MySQL / Monitoring: General (Apache Struts 2) (3.4.9.4237 and prior, 4.0.6.5281 and prior, 8.0.2.8191 and prior)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications Applications Security (Apache Struts 2) prior to 12.5
Oracle Enterprise Manager Reporting Framework (Apache Struts 2) 13.3.0.0, 13.4.0.0 13.3.0.0 · 13.4.0.0
Oracle MySQL Monitoring: General (Apache Struts 2) 3.4.9.4237 and prior, 4.0.6.5281 and prior, 8.0.2.8191 and prior

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.apache.struts:struts2-core 2.0.4 2.3.35 unbounded
org.apache.struts:struts2-core 2.5 2.5.17 unbounded

Products and versions

9 products, 15 version entries
SourceVendorProductSchemeAffected versions
nvd apache struts generic ≥ 2.0.4 and ＜ 2.3.35 · ≥ 2.5.0 and ＜ 2.5.17
nvd netapp active iq unified manager generic ≥ 7.3 · ≥ 9.5
nvd netapp oncommand insight generic any version
nvd netapp oncommand workflow automation generic any version
nvd netapp snapcenter generic any version
nvd oracle communications policy management generic ＜ 12.5.0
nvd oracle enterprise manager base platform generic 13.3.0.0 · 13.4.0.0
nvd oracle mysql enterprise monitor generic ≤ 3.4.9.4237 · ≥ 4.0.0 and ≤ 4.0.6.5281 · ≥ 8.0.0 and ≤ 8.0.2.8191
osv org.apache.struts struts2-core generic ≥ 2.0.4 and ＜ 2.3.35 · ≥ 2.5 and ＜ 2.5.17

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** HTTP, SECURITY (APACHE STRUTS 2), REPORTING FRAMEWORK (APACHE STRUTS 2), NO AUTH REMOTE EXPLOIT, MONITORING: GENERAL (APACHE STRUTS 2) **Products:** APACHE STRUTS 2

References

URLTags
https://github.com/apache/struts/commit/6e87474f9ad0549f07dd2c37d50a9ccd0977c6e WEB
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html WEB
https://www.oracle.com/security-alerts/cpujul2020.html WEB
https://www.exploit-db.com/exploits/45367 WEB
https://www.exploit-db.com/exploits/45262 WEB
https://www.exploit-db.com/exploits/45260 WEB
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-11776 WEB
https://web.archive.org/web/20201208145803/https://securitytracker.com/id/1041547 WEB
https://web.archive.org/web/20200807025819/http://www.securitytracker.com/id/1041888 WEB
https://web.archive.org/web/20180822160726/http://www.securityfocus.com/bid/105125 WEB

Timeline
Published2018-08-22By the CVE Program.
VulnCheck KEV: earliest evidence2018-12-18Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2021-11-03Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: latest evidence2025-12-26Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-06-17NVD's own last-modified date for this record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.