Patchfirst
Patchfirst
CVE-2017-12611 Public exploit EPSS 87.1%

In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.

Apache Software Foundation · Apache Struts

Summary

The flaw is in Apache Struts (Apache Software Foundation), affecting versions 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, where an unintended expression is used in a Freemarker tag in place of a string literal. An attacker who can get such a tag to evaluate attacker-controlled input could achieve remote code execution.

Heading is the official description · CVE.org
Breakdown
61.9 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 7 years after disclosure. Public exploit code (Exploit-DB) was available 12 days before disclosure.

  1. Public exploit codeExploit-DB12 days before
  2. Disclosedday 0
  3. First seen exploitedVulnCheck KEV evidence+7 yrs

8 fixes in struts2-core over 2 years. The latest fix listed for struts2-core is 2.5.17.

Fixes in struts2-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 2.3.29CVE-2016-446116 Oct 2017
  2. 2.5.1CVE-2016-44363 Oct 2016
  3. 2.5.10.1CVE-2017-563811 Mar 2017KEV
  4. 2.5.11CVE-2017-1261120 Sep 2017
  5. 2.5.12CVE-2017-767213 Jul 2017
  6. 2.5.12CVE-2017-978713 Jul 2017
  7. 2.5.13CVE-2016-44654 Jul 2016
  8. 2.5.17CVE-2018-1177622 Aug 2018KEVLatest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.struts:struts2-core.

Mavenorg.apache.struts:struts2-coreGHSA-8fx9-5hx8-crhm

Upgrade to 2.5.33

Fixes this CVE and 7 other known vulnerabilities in this package (CVE-2017-5638, CVE-2018-11776, +5).

Still affected on this line by CVE-2024-53677 (fixed in 6.4.0, a newer line); CVE-2025-68493 (no fix published).

Set the version to 2.5.33 or later in your pom.xml or build.gradle.

First fixed in 2.5.11 for CVE-2017-12611.

Affected versions, by release line

If you runUpgrade to
2.5.0 up to 2.5.112.5.33first fix for this CVE: 2.5.11
2.0.1 up to 2.3.34

Still affected on this line by CVE-2019-0230 (fixed in 2.5.22, a newer line); CVE-2019-0233 (fixed in 2.5.22, a newer line); CVE-2020-17530 (fixed in 2.5.26, a newer line); CVE-2021-31805 (fixed in 2.5.30, a newer line); CVE-2023-50164 (fixed in 2.5.33, a newer line); CVE-2024-53677 (fixed in 6.4.0, a newer line); CVE-2025-68493 (no fix published).

2.3.35first fix for this CVE: 2.3.34

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 6 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

5 links, grouped by NVD tag

x_refsource_CONFIRM 4

oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.htmlarubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txtstruts.apache.org/docs/s2-053.htmlkb.netapp.com/support/s/article/ka51A000000CgttQAC/NTAP-20170911-0001

vdb-entry 1

securityfocus.com/bid/100829
↑ ↓ chooseEnter openEsc close