http://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.html

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txt

http://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

http://www.securityfocus.com/bid/105125

http://www.securitytracker.com/id/1041547

http://www.securitytracker.com/id/1041888

https://cwiki.apache.org/confluence/display/WW/S2-057

https://github.com/hook-s3c/CVE-2018-11776-Python-PoC

https://lgtm.com/blog/apache_struts_CVE-2018-11776

https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0012

https://security.netapp.com/advisory/ntap-20180822-0001/

https://security.netapp.com/advisory/ntap-20181018-0002/

https://www.exploit-db.com/exploits/45260/

https://www.exploit-db.com/exploits/45262/

https://www.exploit-db.com/exploits/45367/

https://www.oracle.com/security-alerts/cpujul2020.html

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

NIST AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NIST AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NIST NVD-CWE-noinfo

NIST CWE-20

OR
     *cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* versions from (including) 2.3.1 up to (including) 2.3.34
     *cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* versions from (including) 2.5.0 up to (including) 2.5.16

OR
     *cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* versions from (including) 2.0.4 up to (excluding) 2.3.35
     *cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* versions from (including) 2.5.0 up to (excluding) 2.5.17

OR
     *cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:* versions from (including) 7.3
     *cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:* versions from (including) 9.5
     *cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
     *cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
     *cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*

OR
     *cpe:2.3:a:oracle:communications_policy_management:*:*:*:*:*:*:*:* versions up to (excluding) 12.5.0
     *cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:*
     *cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*
     *cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* versions up to (including) 3.4.9.4237
     *cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* versions from (including) 4.0.0 up to (including) 4.0.6.5281
     *

http://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.html No Types Assigned

http://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.html Third Party Advisory, VDB Entry

http://www.securityfocus.com/bid/105125 Third Party Advisory, VDB Entry

http://www.securityfocus.com/bid/105125 Broken Link, Third Party Advisory, VDB Entry

http://www.securitytracker.com/id/1041547 Third Party Advisory, VDB Entry

http://www.securitytracker.com/id/1041547 Broken Link, Third Party Advisory, VDB Entry

http://www.securitytracker.com/id/1041888 Third Party Advisory, VDB Entry

http://www.securitytracker.com/id/1041888 Broken Link, Third Party Advisory, VDB Entry

https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E No Types Assigned

https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E Mailing List

https://www.oracle.com/security-alerts/cpujul2020.html No Types Assigned

https://www.oracle.com/security-alerts/cpujul2020.html Third Party Advisory

Apache Software Foundation https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E [No types assigned]

Apache Software Foundation https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3Cannounce.apache.org%3E

http://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.html [No Types Assigned]

https://www.oracle.com/security-alerts/cpujul2020.html [No Types Assigned]

https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3Cannounce.apache.org%3E [No Types Assigned]

http://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787.html Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787.html Patch, Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch, Third Party Advisory

http://www.securitytracker.com/id/1041888 Third Party Advisory

http://www.securitytracker.com/id/1041888 Third Party Advisory, VDB Entry

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html No Types Assigned

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch, Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html [No Types Assigned]

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

(AV:N/AC:M/Au:N/C:C/I:C/A:C)

CWE-20

OR
     *cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* versions from (including) 2.3.1 up to (including) 2.3.34
     *cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* versions from (including) 2.5.0 up to (including) 2.5.16

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txt No Types Assigned

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txt Mailing List, Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787.html No Types Assigned

http://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787.html Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html No Types Assigned

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Third Party Advisory

http://www.securityfocus.com/bid/105125 No Types Assigned

http://www.securityfocus.com/bid/105125 Third Party Advisory, VDB Entry

http://www.securitytracker.com/id/1041547 No Types Assigned

http://www.securitytracker.com/id/1041547 Third Party Advisory, VDB Entry

http://www.securitytracker.com/id/1041888 No Types Assigned

http://www.securitytracker.com/id/1041888 Third Party Advisory

https://cwiki.apache.org/confluence/display/WW/S2-057 No Types Assigned

https://cwiki.apache.org/confluence/display/WW/S2-057 Issue Tracking, Third Party Advisory

https://github.com/hook-s3c/CVE-2018-11776-Python-PoC No Types Assigned

https://github.com/hook-s3c/CVE-2018-11776-Python-PoC Exploit, Third Party Advisory

https://lgtm.com/blog/apache_struts_CVE-2018-11776 No Types Assigned

https://lgtm.com/blog/apache_struts_CVE-2018-11776 Exploit, Third Party Advisory

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0012 No Types Assigned

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0012 Third Party Advisory

https://security.netapp.com/advisory/ntap-20180822-0001/ No Types Assigned

https://security.netapp.com/advisory/ntap-20180822-0001/ Third Party Advisory

https://security.netapp.com/advisory/ntap-20181018-0002/ No Types Assigned

https://security.netapp.com/advisory/ntap-20181018-0002/ Third Party Advisory

https://www.exploit-db.com/exploits/45260/ No Types Assigned

https://www.exploit-db.com/exploits/45260/ Exploit, Third Party Advisory, VDB Entry

https://www.exploit-db.com/exploits/45262/ No Types Assigned

https://www.exploit-db.com/exploits/45262/ Exploit, Third Party Advisory, VDB Entry

https://www.exploit-db.com/exploits/45367/ No Types Assigned

https://www.exploit-db.com/exploits/45367/ Exploit, Third Party Advisory, VDB Entry

https://security.netapp.com/advisory/ntap-20181018-0002/ [No Types Assigned]

http://www.securitytracker.com/id/1041888 [No Types Assigned]

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0012 [No Types Assigned]

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html [No Types Assigned]

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when using results with no namespace and in same time, its upper action(s) have no or wildcard namespace. Same possibility when using url tag which doesn't have value and action set and in same time, its upper action(s) have no or wildcard namespace.

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.

https://www.exploit-db.com/exploits/45367/ [No Types Assigned]

http://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787.html [No Types Assigned]

https://github.com/hook-s3c/CVE-2018-11776-Python-PoC [No Types Assigned]

https://www.exploit-db.com/exploits/45260/ [No Types Assigned]

https://www.exploit-db.com/exploits/45262/ [No Types Assigned]

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txt [No Types Assigned]

https://lgtm.com/blog/apache_struts_CVE-2018-11776 [No Types Assigned]

http://www.securityfocus.com/bid/105125 [No Types Assigned]

http://www.securitytracker.com/id/1041547 [No Types Assigned]

https://security.netapp.com/advisory/ntap-20180822-0001/ [No Types Assigned]