{"id":"CVE-2017-5638","published":"2017-03-11T02:59:00Z","modified":"2026-06-17T01:20:54Z","title":"Apache Struts Remote Code Execution Vulnerability","vendor":"Apache","product":"Struts","tier":"core","eol":null,"description":{"text":"The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.","provenance":"source","from":"NVD"},"summary":{"text":"The Jakarta Multipart parser in Apache Struts 2 (versions 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1) mishandles exceptions and error messages raised during file-upload processing. An unauthenticated remote attacker with network access can execute arbitrary commands by sending a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, with no user interaction or special configuration required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:57:34Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99999,"percentile":0.99994,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-5638","provenance":"source"},"vulncheckKev":{"dateAdded":"2017-03-11","exploitedFirstSeen":"2017-03-11","ransomware":true,"evidence":[{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5638","date":"2017-03-11"},{"url":"https://www.f5.com/labs/articles/threat-intelligence/from-ddos-to-server-ransomware-apache-struts-2-cve-2017-5638-campaign-25922","date":"2017-03-27"},{"url":"https://isc.sans.edu/diary/Java+Struts2+Vulnerability+Used+To+Install+Cerber+Crypto+Ransomware/22264","date":"2017-04-06"},{"url":"https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/2017-notable-vulnerabilities-and-exploits","date":"2017-12-06"},{"url":"https://cisa.gov/news-events/ics-alerts/ics-alert-14-281-01","date":"2018-08-23"},{"url":"https://blog.lumen.com/the-resilient-satori-botnet/","date":"2018-10-27"},{"url":"https://www.lacework.com/blog/elf-of-the-month-new-lucky-ransomware-sample/","date":"2019-01-08"},{"url":"https://www.alibabacloud.com/blog/threat-alert-multiple-cryptocurrency-miner-botnets-start-to-exploit-the-new-thinkphp-vulnerability_594369","date":"2019-01-13"},{"url":"https://www.f5.com/labs/articles/threat-intelligence/vulnerabilities-exploits-and-malware-driving-attack-campaigns-march-2019","date":"2019-04-09"},{"url":"https://blogs.juniper.net/en-us/threat-research/satan-ransomware-used-in-multi-platform-cryptomining-and-ransomware-campaign","date":"2019-06-15"}],"evidenceTotal":590,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-755","name":"Improper Handling of Exceptional Conditions"},{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html","tags":["Exploit","Third Party Advisory"]},{"url":"http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/","tags":["Exploit","Third Party Advisory"]},{"url":"http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt","tags":["Third Party Advisory"]},{"url":"http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html","tags":["Press/Media Coverage","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","tags":["Patch","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/96729","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1037973","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/","tags":["Exploit","Press/Media Coverage"]},{"url":"https://cwiki.apache.org/confluence/display/WW/S2-045","tags":["Mitigation","Vendor Advisory"]},{"url":"https://cwiki.apache.org/confluence/display/WW/S2-046","tags":["Mitigation","Vendor Advisory"]},{"url":"https://exploit-db.com/exploits/41570","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519a","tags":["Broken Link"]},{"url":"https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228","tags":["Broken Link"]},{"url":"https://github.com/mazen160/struts-pwn","tags":["Exploit"]},{"url":"https://github.com/rapid7/metasploit-framework/issues/8064","tags":["Exploit","Issue Tracking"]},{"url":"https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03733en_us","tags":["Broken Link"]},{"url":"https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03749en_us","tags":["Third Party Advisory"]},{"url":"https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_us","tags":["Third Party Advisory"]},{"url":"https://isc.sans.edu/diary/22169","tags":["Exploit","Third Party Advisory"]},{"url":"https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E","tags":["Mailing List"]},{"url":"https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html","tags":["Exploit","Third Party Advisory"]},{"url":"https://packetstormsecurity.com/files/141494/S2-45-poc.py.txt","tags":["Broken Link","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://security.netapp.com/advisory/ntap-20170310-0001/","tags":["Third Party Advisory"]},{"url":"https://struts.apache.org/docs/s2-045.html","tags":["Mitigation","Vendor Advisory"]},{"url":"https://struts.apache.org/docs/s2-046.html","tags":["Mitigation","Vendor Advisory"]},{"url":"https://support.lenovo.com/us/en/product_security/len-14200","tags":["Third Party Advisory"]},{"url":"https://twitter.com/theog150/status/841146956135124993","tags":["Broken Link","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/41614/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/","tags":["Third Party Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/834067","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.symantec.com/security-center/network-protection-security-advisories/SA145","tags":["Broken Link"]},{"url":"http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html","tags":["Exploit","Third Party Advisory"]},{"url":"http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/","tags":["Exploit","Third Party Advisory"]},{"url":"http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt","tags":["Third Party Advisory"]},{"url":"http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html","tags":["Press/Media Coverage","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","tags":["Patch","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/96729","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1037973","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/","tags":["Exploit","Press/Media Coverage"]},{"url":"https://cwiki.apache.org/confluence/display/WW/S2-045","tags":["Mitigation","Vendor Advisory"]},{"url":"https://cwiki.apache.org/confluence/display/WW/S2-046","tags":["Mitigation","Vendor Advisory"]},{"url":"https://exploit-db.com/exploits/41570","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519a","tags":["Broken Link"]},{"url":"https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228","tags":["Broken Link"]},{"url":"https://github.com/mazen160/struts-pwn","tags":["Exploit"]},{"url":"https://github.com/rapid7/metasploit-framework/issues/8064","tags":["Exploit","Issue Tracking"]},{"url":"https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03733en_us","tags":["Broken Link"]},{"url":"https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03749en_us","tags":["Third Party Advisory"]},{"url":"https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_us","tags":["Third Party Advisory"]},{"url":"https://isc.sans.edu/diary/22169","tags":["Exploit","Third Party Advisory"]},{"url":"https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E","tags":["Mailing List"]},{"url":"https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html","tags":["Exploit","Third Party Advisory"]},{"url":"https://packetstormsecurity.com/files/141494/S2-45-poc.py.txt","tags":["Broken Link","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://security.netapp.com/advisory/ntap-20170310-0001/","tags":["Third Party Advisory"]},{"url":"https://struts.apache.org/docs/s2-045.html","tags":["Mitigation","Vendor Advisory"]},{"url":"https://struts.apache.org/docs/s2-046.html","tags":["Mitigation","Vendor Advisory"]},{"url":"https://support.lenovo.com/us/en/product_security/len-14200","tags":["Third Party Advisory"]},{"url":"https://twitter.com/theog150/status/841146956135124993","tags":["Broken Link","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/41614/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/","tags":["Third Party Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/834067","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.symantec.com/security-center/network-protection-security-advisories/SA145","tags":["Broken Link"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5638","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2017-5638  is a remote code execution vulnerability in Apache Struts Jakarta Multipart versions that allows for malicious file upload using Content-Type, Content-Disposition, or Content-Length HTTP headers during file-upload attempts leading to an attacker to execute arbitrary commands. This CVE was known to be exploited during the Equifax breach. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":"CVE-2017-5638  is a remote code execution vulnerability in Apache Struts Jakarta Multipart versions that allows for malicious file upload using Content-Type, Content-Disposition, or Content-Length HTTP headers during file-upload attempts leading to an attacker to execute arbitrary commands. This CVE was known to be exploited during the Equifax breach. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2017-5638  is a remote code execution vulnerability in Apache Struts Jakarta Multipart versions that allows for malicious file upload using Content-Type, Content-Disposition, or Content-Length HTTP headers during file-upload attempts leading to an attacker to execute arbitrary commands. This CVE was known to be exploited during the Equifax breach. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"}],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.3.0, <2.3.32",">=2.5.0, <2.5.10.1"],"patched":["2.3.32","2.5.10.1"],"from":["GHSA-j77q-2qqg-6989"],"provenance":"source"}],"advisories":[{"id":"GHSA-j77q-2qqg-6989","url":"https://github.com/advisories/GHSA-j77q-2qqg-6989","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.3.0, <2.3.32"],"patched":["2.3.32"],"provenance":"source","from":"GHSA"},{"id":"GHSA-j77q-2qqg-6989","url":"https://github.com/advisories/GHSA-j77q-2qqg-6989","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.5.0, <2.5.10.1"],"patched":["2.5.10.1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2018-0625","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-0625","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":41570,"url":"https://www.exploit-db.com/exploits/41570","title":"Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - Remote Code Execution","type":"webapps","platform":"linux","date":"2017-03-07","verified":true,"provenance":"source"},{"id":41614,"url":"https://www.exploit-db.com/exploits/41614","title":"Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - 'Jakarta' Multipart Parser OGNL Injection (Metasploit)","type":"remote","platform":"multiple","date":"2017-03-15","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2017-03-07"},"pocGithub":{"count":73,"skipped":14,"earliest":"2017-03-07","earliestUrl":"https://github.com/PolarisLab/S2-045","repos":[{"name":"mazen160/struts-pwn","url":"https://github.com/mazen160/struts-pwn","stars":443,"created":"2017-03-12"},{"name":"Flyteas/Struts2-045-Exp","url":"https://github.com/Flyteas/Struts2-045-Exp","stars":61,"created":"2017-03-07"},{"name":"immunio/apache-struts2-CVE-2017-5638","url":"https://github.com/immunio/apache-struts2-CVE-2017-5638","stars":34,"created":"2017-03-10"},{"name":"jas502n/S2-045-EXP-POC-TOOLS","url":"https://github.com/jas502n/S2-045-EXP-POC-TOOLS","stars":25,"created":"2017-03-09"},{"name":"PolarisLab/S2-045","url":"https://github.com/PolarisLab/S2-045","stars":23,"created":"2017-03-07"}]},"metasploit":[{"name":"Apache Struts Jakarta Multipart Parser OGNL Injection","module":"exploit/multi/http/struts2_content_type_ognl","type":"exploit","disclosureDate":"2017-03-07","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts2_content_type_ognl.rb"}],"nuclei":[{"id":"CVE-2017-5638","name":"Apache Struts 2 - Remote Command Execution","severity":"critical","path":"http/cves/2017/CVE-2017-5638.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-5638.yaml"}],"first":{"date":"2017-03-07","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/41570"},"provenance":"source"},"detections":{"cveRules":[{"title":"Potential OGNL Injection Exploitation In JVM Based Application","id":"4d0af518-828e-4a04-a751-a7d03f3046ad","level":"high","status":"test","path":"rules/application/jvm/java_ognl_injection_exploitation_attempt.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules/application/jvm/java_ognl_injection_exploitation_attempt.yml","techniques":["T1190"]}]},"exploitRefs":["http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html","http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/","https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/","https://exploit-db.com/exploits/41570","https://github.com/mazen160/struts-pwn","https://github.com/rapid7/metasploit-framework/issues/8064","https://isc.sans.edu/diary/22169","https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html","https://packetstormsecurity.com/files/141494/S2-45-poc.py.txt","https://www.exploit-db.com/exploits/41614/","https://www.exploit-db.com/exploits/41614"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"secondary","techniques":["T1005"],"provenance":"source"},{"stage":"related","techniques":["T1203","T1068"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2017-03-07","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-41570); later: PoC-in-GitHub 2017-03-07, Metasploit 2017-03-07","url":"https://www.exploit-db.com/exploits/41570","provenance":"source"},{"date":"2017-03-11","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5638","provenance":"source"},{"date":"2017-03-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cve.org/CVERecord?id=CVE-2017-5638","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-0625","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":1698},"priority":{"score":79.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3519 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9999"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"10 NVD references tagged Exploit; 2 Exploit-DB entries; 1 advisory exploit reference; 73 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-apache-struts-cwe-20","packageHistory":[{"cve":"CVE-2016-4438","published":"2016-07-04","fixed":"2.3.29","kev":false},{"cve":"CVE-2016-4461","published":"2017-10-16","fixed":"2.3.29","kev":false},{"cve":"CVE-2016-4436","published":"2016-10-03","fixed":"2.5.1","kev":false,"link":{"from":"CVE-2016-4436","to":"CVE-2017-5638","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts:struts2-core","fromFixed":"2.5.1","toFixed":"2.5.10.1","daysApart":159}]}},{"cve":"CVE-2017-5638","published":"2017-03-11","fixed":"2.5.10.1","kev":true},{"cve":"CVE-2017-12611","published":"2017-09-20","fixed":"2.5.11","kev":false,"link":{"from":"CVE-2017-5638","to":"CVE-2017-12611","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts:struts2-core","fromFixed":"2.5.10.1","toFixed":"2.5.11","daysApart":193}]}},{"cve":"CVE-2017-7672","published":"2017-07-13","fixed":"2.5.12","kev":false},{"cve":"CVE-2017-9787","published":"2017-07-13","fixed":"2.5.12","kev":false,"link":{"from":"CVE-2017-5638","to":"CVE-2017-9787","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts:struts2-core","fromFixed":"2.3.32","toFixed":"2.3.33","daysApart":124}]}}],"package":"Maven:org.apache.struts:struts2-core"}}