CVE-2018-11776— Apache Struts 输入验证错误漏洞
Public Exploits 5
Metasploit · 1 struts2_namespace_ognl.rb [exploit]
Nuclei · 1 CVE-2018-11776.yaml [template]
In-the-Wild Activity Observed cisa_kev · confirmed
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2018-11776の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
N/A
ソース: CVE Program / CVE List V5
脆弱性説明
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
ソース: CVE Program / CVE List V5
CVSS情報
N/A
ソース: CVE Program / CVE List V5
脆弱性タイプ
N/A
ソース: CVE Program / CVE List V5
脆弱性タイトル
Apache Struts 输入验证错误漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Apache Struts是美国阿帕奇（Apache）软件基金会负责维护的一个开源项目，是一套用于创建企业级Java Web应用的开源MVC框架，主要提供两个版本框架产品，Struts 1和Struts 2。Apache Struts 2是Apache Struts的下一代产品，是在Struts 1和WebWork的技术基础上进行了合并的全新Struts 2框架，其体系结构与Struts 1差别较大。 Apache Struts 2.3版本至2.3.34版本和2.5版本至2.5.16版本中存在输入验证漏洞
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| Apache Software Foundation | Apache Struts | 2.3 to 2.3.34 | - |
II. CVE-2018-11776の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|---|---|---|
| 1 | Creating a vulnerable environment and the PoC | https://github.com/xfox64x/CVE-2018-11776 | POC詳細 |
| 2 | CVE-2018-11776(S2-057) EXPLOIT CODE | https://github.com/jiguangsdf/CVE-2018-11776 | POC詳細 |
| 3 | Working Python test and PoC for CVE-2018-11776, includes Docker lab | https://github.com/hook-s3c/CVE-2018-11776-Python-PoC | POC詳細 |
| 4 | An exploit for Apache Struts CVE-2018-11776 | https://github.com/mazen160/struts-pwn_CVE-2018-11776 | POC詳細 |
| 5 | Vulnerable docker container for CVE-2018-11776 | https://github.com/bhdresh/CVE-2018-11776 | POC詳細 |
| 6 | Environment for CVE-2018-11776 / S2-057 (Apache Struts 2) | https://github.com/knqyf263/CVE-2018-11776 | POC詳細 |
| 7 | Proof of Concept for CVE-2018-11776 | https://github.com/Ekultek/Strutter | POC詳細 |
| 8 | None | https://github.com/tuxotron/cve-2018-11776-docker | POC詳細 |
| 9 | A simple exploit for Apache Struts RCE S2-057 (CVE-2018-11776) | https://github.com/brianwrf/S2-057-CVE-2018-11776 | POC詳細 |
| 10 | This tool takes advantage of CVE-2018-11776 and Shodan to perform mass exploitation of verified and vulnerable Apache Struts servers. | https://github.com/649/Apache-Struts-Shodan-Exploit | POC詳細 |
| 11 | None | https://github.com/jezzus/CVE-2018-11776-Python-PoC | POC詳細 |
| 12 | cve-2018-11776 | https://github.com/cved-sources/cve-2018-11776 | POC詳細 |
| 13 | Spins up an isolated test environment for experimentation with Apache Struts vulnerability CVE-2018-11776. | https://github.com/OzNetNerd/apche-struts-vuln-demo-cve-2018-11776 | POC詳細 |
| 14 | Investigation of CVE-2018-11776 vulnerability that allows attackers to remotely execute code and gain control over Apache Struts-based applications. | https://github.com/cucadili/CVE-2018-11776 | POC詳細 |
| 15 | Critical Remote Code Execution Vulnerability (CVE-2018-11776) Found in Apache Struts. | https://github.com/ArunBhandarii/Apache-Struts-0Day-Exploit | POC詳細 |
| 16 | None | https://github.com/freshdemo/ApacheStruts-CVE-2018-11776 | POC詳細 |
| 17 | None | https://github.com/sonpt-afk/CVE-2018-11776-FIS | POC詳細 |
| 18 | Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible remote code execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn''t have value and action set and in same time, its upper package have no or wildcard namespace. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11776.yaml | POC詳細 |
| 19 | None | https://github.com/Threekiii/Awesome-POC/blob/master/%E4%B8%AD%E9%97%B4%E4%BB%B6%E6%BC%8F%E6%B4%9E/Apache%20Struts2%20S2-057%20%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2018-11776.md | POC詳細 |
| 20 | Critical Remote Code Execution Vulnerability (CVE-2018-11776) Found in Apache Struts. | https://github.com/arlyone/Apache-Struts-0Day-Exploit | POC詳細 |
| 21 | PoC Script for the CVE-2018-11776 vuln | https://github.com/m4sk0ff/CVE-2018-11776 | POC詳細 |
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2018-11776のインテリジェンス情報
请登录查看更多情报信息。
CVE-2018-11776 厂商安全公告 (9)
CVE-2018-11776 公开利用代码 (4)
CVE-2018-11776 邮件列表归档 (1)
CVE-2018-11776 安全博客文章 (1)
CVE-2018-11776 其他参考 (4)
IV. 関連脆弱性
同じ製品: Apache Struts
- CVE-2026-73632
Apache Struts: Shared serialization state in the JSON plugin - CVE-2026-73631
Apache Struts: Shared parsing state in the JSON plugin - CVE-2026-73635
Apache Struts: Unbounded growth of localized-text caches dri - CVE-2026-73634
Apache Struts: Unbounded read of a Content Security Policy v - CVE-2026-73633
Apache Struts: Unbounded read of a JSON request body
同じベンダー: Apache Software Foundation
- CVE-2026-34884
Apache SkyWalking MCP: SSRF via set_skywalking_url Tool and - CVE-2026-73632
Apache Struts: Shared serialization state in the JSON plugin - CVE-2026-73631
Apache Struts: Shared parsing state in the JSON plugin - CVE-2026-73635
Apache Struts: Unbounded growth of localized-text caches dri - CVE-2026-73634
Apache Struts: Unbounded read of a Content Security Policy v
V. CVE-2018-11776へのコメント
まだコメントはありません