ZeroDay Findings
Sign inSign up

Findings

CVE-2018-11776

Apache Struts Remote Code Execution Vulnerability

Published Aug 22, 2018 · updated Jun 16, 2026 · apache struts

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 22, 2018 · Catalog

    Detected

    Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 3, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set

Required action

Apply updates per vendor instructions.

CISA due date May 3, 2022

Affected

  • cpe apache/strutsversion unspecified
  • cpe netapp/active iq unified managerversion unspecified
  • cpe netapp/oncommand insightversion unspecified
  • cpe netapp/oncommand workflow automationversion unspecified
  • cpe netapp/snapcenterversion unspecified
  • cpe oracle/communications policy managementversion unspecified
  • vendor Apache Strutsversion unspecified

Sources

  • CISA KEVCVE-2018-11776

    Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace. Or, using URL tag which doesn't have value and action set and in same time, its upper p

    cisa.gov
  • CVE.orgCVE-2018-11776

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2018-11776

    30-day exploitation probability 100.0%

    first.org
  • Exploit Database45260

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database45367

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_multi/http/struts2_namespace_ognl

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2018-11776

    Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References