CVE-2017-12611
CRITICAL EXPLOITED IN THE WILD NUCLEIApache Struts < 2.3.34 - Improper Input Validation
Title source: ruleDescription
In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
Exploits (6)
exploitdb
WORKING POC
VERIFIED
by brianwrf · pythonremotemultiple
https://www.exploit-db.com/exploits/44556
github
WRITEUP
3,480 stars
by qazbnm456 · poc
https://github.com/qazbnm456/awesome-cve-poc/tree/master/CVE-2017-12611.md
github
WRITEUP
14 stars
by xbl3 · poc
https://github.com/xbl3/awesome-cve-poc_qazbnm456/tree/master/CVE-2017-12611.md
Nuclei Templates (1)
Apache Struts2 S2-053 - Remote Code Execution
CRITICALby pikpikcu
Shodan:
http.html:"apache struts" || http.title:"struts2 showcase" || http.html:"struts problem report"
FOFA:
body="struts problem report" || title="struts2 showcase" || body="apache struts"
References (5)
Scores
CVSS v3
9.8
EPSS
0.9423
EPSS Percentile
99.9%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
VulnCheck KEV
2024-04-15
InTheWild.io
2018-03-07
CWE
CWE-20
Status
published
Products (50)
apache/struts
2.0.1
apache/struts
2.0.2
apache/struts
2.0.3
apache/struts
2.0.4
apache/struts
2.0.5
apache/struts
2.0.6
apache/struts
2.0.7
apache/struts
2.0.8
apache/struts
2.0.9
apache/struts
2.0.10
... and 40 more
Published
Sep 20, 2017
Tracked Since
Feb 18, 2026