ZeroDay Findings
Sign inSign up

Findings

CVE-2017-5638

Apache Struts Remote Code Execution Vulnerability

Published Mar 10, 2017 · updated Jun 16, 2026 · apache struts

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 10, 2017 · Catalog

    Detected

    The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containin

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 3, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containin

Required action

Apply updates per vendor instructions.

CISA due date May 3, 2022

Affected

  • cpe apache/strutsversion unspecified
  • cpe arubanetworks/clearpass policy managerversion unspecified
  • cpe hp/server automation9.1.0
  • cpe ibm/storwize v3500 firmware7.7.1.6
  • cpe ibm/storwize v3500 firmware7.8.1.0
  • cpe ibm/storwize v5000 firmware7.7.1.6
  • cpe ibm/storwize v5000 firmware7.8.1.0
  • cpe ibm/storwize v7000 firmware7.7.1.6
  • cpe ibm/storwize v7000 firmware7.8.1.0
  • cpe lenovo/storage v5030 firmware7.7.1.6
  • cpe oracle/weblogic server10.3.6.0.0
  • vendor Apache Strutsversion unspecified

Sources

  • CISA KEVCVE-2017-5638

    Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.

    cisa.gov
  • CVE.orgCVE-2017-5638

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2017-5638

    30-day exploitation probability 100.0%

    first.org
  • Exploit Database41570

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database41614

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_multi/http/struts2_content_type_ognl

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2017-5638

    The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content

    nvd.nist.gov

References