Evil-DB LogoEvil-DB
← All CVEs

CVE-2017-12611

critical · 9.8

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.

9.8
CVSS
87.1%
EPSS (exploit prob.)
100th
EPSS percentile
2017-09-20
Published

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-20

Affected products

VendorProductAffected versions
apachestruts2.0.1
apachestruts2.0.2
apachestruts2.0.3
apachestruts2.0.4
apachestruts2.0.5
apachestruts2.0.6
apachestruts2.0.7
apachestruts2.0.8
apachestruts2.0.9
apachestruts2.0.10
apachestruts2.0.11
apachestruts2.0.11.1
apachestruts2.0.11.2
apachestruts2.0.12
apachestruts2.0.13
apachestruts2.0.14
apachestruts2.1.0
apachestruts2.1.1
apachestruts2.1.2
apachestruts2.1.3
apachestruts2.1.4
apachestruts2.1.5
apachestruts2.1.6
apachestruts2.1.8
apachestruts2.1.8.1
apachestruts2.2.1
apachestruts2.2.1.1
apachestruts2.2.3
apachestruts2.2.3.1
apachestruts2.3.1
apachestruts2.3.1.1
apachestruts2.3.1.2
apachestruts2.3.3
apachestruts2.3.4
apachestruts2.3.4.1
apachestruts2.3.5
apachestruts2.3.6
apachestruts2.3.7
apachestruts2.3.8
apachestruts2.3.9

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2017-12611