CVE-2018-11776
published 2018-08-22CVE-2018-11776: Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a…
PriorityP195high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2022-05-03
Exploited in the wild
EPSS
99.99%
100.0th percentile
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | struts | >= 2.0.4 < 2.3.35 | 2.3.35 |
| apache | struts | >= 2.5.0 < 2.5.17 | 2.5.17 |
| apache_software_foundation | apache_struts | — | — |
| apache_software_foundation | apache_struts | — | — |
| netapp | active_iq_unified_manager | >= 7.3 | — |
| netapp | active_iq_unified_manager | >= 9.5 | — |
| oracle | communications_policy_management | < 12.5.0 | 12.5.0 |
| oracle | enterprise_manager_base_platform | — | — |
| oracle | enterprise_manager_base_platform | — | — |
| oracle | mysql_enterprise_monitor | <= 3.4.9.4237 | — |
| oracle | mysql_enterprise_monitor | 4.0.0 – 4.0.6.5281 | — |
| oracle | mysql_enterprise_monitor | 8.0.0 – 8.0.2.8191 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Scan for vulnerable Struts by sending crafted payloads to .action, .go, .do, .jsp and .xhtml files under common web directories and checking for command execution evidence. ↗
- →For authenticated Linux/Unix detection, execute 'ps -ef', look for the Tomcat process, and locate the struts2-core-x.jar file to confirm vulnerable Struts versions. ↗
- →For unauthenticated remote detection, use a plugin that attempts to exploit the vulnerability and sends an ICMP echo (ping) request from the remote host back to the scanner host to verify successful exploitation. ↗
- →Monitor for outbound connections to cryptomining pool us-east.cryptonight-hub.miningpoolhub.com on TCP port 20580 as a post-exploitation indicator. ↗
- ·The vulnerability only exists when 'alwaysSelectFullNamespace' is true AND results/url tags lack a namespace or use a wildcard namespace — it does NOT exist in a default Struts configuration. ↗
- ·The alwaysSelectFullNamespace flag is automatically set to true when the Struts Convention plugin is in use, broadening the attack surface beyond explicit configuration. ↗
- ·Authenticated version-based plugins (e.g., Tenable Plugin 112036) cannot determine if a workaround is in place and must be run with 'Show potential false alarms' accuracy setting. ↗
- ·The remote unauthenticated Tenable plugin (112064) will not work from Tenable.io scanner pools due to the nature of the blind RCE verification mechanism; on-prem scanners are required. ↗
- ·The mining pool domain IOC (us-east.cryptonight-hub.miningpoolhub.com) is indicative of cryptomining activity broadly and not exclusively tied to CVE-2018-11776 exploitation. ↗
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck8.1HIGH
cisa8.1HIGH
vendor_oracle8.1HIGH
vendor_redhat8.1HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Apache Struts Remote Code Execution Vulnerability
cisa·2021-11-03·CVSS 8.1
CVE-2018-11776 [HIGH] CWE-20 Apache Struts Remote Code Execution Vulnerability
Vulnerability: Apache Struts Remote Code Execution Vulnerability
Affected: Apache Struts
Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace. Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2018-11776
Remediation Due Date: 2022-05-03
Oracle
Oracle Oracle Enterprise Manager Risk Matrix: Reporting Framework (Apache Struts 2) — CVE-2018-11776
vendor_oracle·2020-07-15·CVSS 8.1
CVE-2018-11776 [HIGH] Oracle Oracle Enterprise Manager Risk Matrix: Reporting Framework (Apache Struts 2) — CVE-2018-11776
Oracle Oracle Enterprise Manager Risk Matrix: Reporting Framework (Apache Struts 2) vulnerability
CVE: CVE-2018-11776
CVSS: 8.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2020 (JUL 2020)
Cisco
Apache Struts Remote Code Execution Vulnerability Affecting Cisco Products: August 2018
vendor_cisco·2018-08-23
CVE-2018-11776 [CRITICAL] CWE-20 Apache Struts Remote Code Execution Vulnerability Affecting Cisco Products: August 2018
Apache Struts Remote Code Execution Vulnerability Affecting Cisco Products: August 2018
A vulnerability in Apache Struts could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system.
The vulnerability exists because the affected software insufficiently validates user-supplied input, allowing the use of results with no namespace value and the use of url tags with no value or action. In cases where upper actions or configurations also have no namespace or a wildcard namespace, an attacker could exploit this vulnerability by sending a request that submits malicious input to the affected application for processing. If successful, the attacker could execute arbitrary code in the security context of the affected application on the targeted system.
The followi
Red Hat
struts2: Using specific results and namespaces can result in a remote code execution
vendor_redhat·2018-08-22·CVSS 8.1
CVE-2018-11776 [HIGH] CWE-20 struts2: Using specific results and namespaces can result in a remote code execution
struts2: Using specific results and namespaces can result in a remote code execution
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
Statement: A previous statement by Red Hat related to this CVE, prior to August 2019, said that Apache Struts 2 is not included in any Red Hat products. This earlier statement was incorrect. While Struts 2 is not actively compiled, shipped, used,
Cisco
Apache Struts Remote Code Execution Vulnerability Affecting Cisco Products: August 2018
vendor_cisco
CVE-2018-11776 Apache Struts Remote Code Execution Vulnerability Affecting Cisco Products: August 2018
CVE-2018-11776: Apache Struts Remote Code Execution Vulnerability Affecting Cisco Products: August 2018
A vulnerability in Apache Struts could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system. The vulnerability exists because the affected software insufficiently validates user-supplied input, allowing the use of results with no namespace value and the use of url tags with no value or action. In cases where upper actions or configurations also have no namespace or a wildcard namespace, an attacker could exploit this vulnerability by sending a request that submits malicious input to the affected application for processing. If successful, the attacker could execute arbitrary code in the security context of the affected application on the targeted system
GHSA
Apache Struts vulnerable to remote command execution (RCE) due to improper input validation
ghsa·2018-10-18
CVE-2018-11776 [HIGH] CWE-20 Apache Struts vulnerable to remote command execution (RCE) due to improper input validation
Apache Struts vulnerable to remote command execution (RCE) due to improper input validation
Apache Struts contains a Remote Code Execution when using results with no namespace and it's upper actions have no or wildcard namespace. The same flaw exists when using a url tag with no value, action set, and it's upper actions have no or wildcard namespace.
OSV
Apache Struts vulnerable to remote command execution (RCE) due to improper input validation
osv·2018-10-18
CVE-2018-11776 [HIGH] Apache Struts vulnerable to remote command execution (RCE) due to improper input validation
Apache Struts vulnerable to remote command execution (RCE) due to improper input validation
Apache Struts contains a Remote Code Execution when using results with no namespace and it's upper actions have no or wildcard namespace. The same flaw exists when using a url tag with no value, action set, and it's upper actions have no or wildcard namespace.
VulnCheck
Apache Struts Remote Code Execution Vulnerability
vulncheck·2018·CVSS 8.1
CVE-2018-11776 [HIGH] CWE-20 Apache Struts Remote Code Execution Vulnerability
Apache Struts Remote Code Execution Vulnerability
Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace. Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.
Affected: Apache Struts
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://blog.talosintelligence.com/2018/12/cryptomining-campaigns-2018.html; https://www.lacework.com/blog/elf-of-the-month-new-lucky-ransomware-sample
Suricata
ET EXPLOIT Apache Struts memberAccess and getWriter inbound OGNL injection remote code execution attempt
suricata·2018-09-05
CVE-2018-11776 ET EXPLOIT Apache Struts memberAccess and getWriter inbound OGNL injection remote code execution attempt
ET EXPLOIT Apache Struts memberAccess and getWriter inbound OGNL injection remote code execution attempt
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Apache Struts memberAccess and getWriter inbound OGNL injection remote code execution attempt"; flow:established,to_server; http.uri; content:"|23|_memberAccess"; fast_pattern; content:".getWriter"; nocase; reference:cve,2018-11776; classtype:attempted-admin; sid:2026094; rev:4; metadata:affected_product Apache_Struts2, attack_target Server, created_at 2018_09_05, cve CVE_2018_11776, deployment Datacenter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_07, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_techniqu
Suricata
ET EXPLOIT Apache Struts getWriter and opensymphony inbound OGNL injection remote code execution attempt
suricata·2018-09-05
CVE-2018-11776 ET EXPLOIT Apache Struts getWriter and opensymphony inbound OGNL injection remote code execution attempt
ET EXPLOIT Apache Struts getWriter and opensymphony inbound OGNL injection remote code execution attempt
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Apache Struts getWriter and opensymphony inbound OGNL injection remote code execution attempt"; flow:established,to_server; http.uri; content:"|2E|getWriter"; fast_pattern; content:"symphony|2E|"; nocase; reference:cve,2018-11776; classtype:attempted-admin; sid:2026096; rev:4; metadata:affected_product Apache_Struts2, attack_target Server, created_at 2018_09_05, cve CVE_2018_11776, deployment Datacenter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_07, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_
Suricata
ET EXPLOIT Apache Struts memberAccess and opensymphony inbound OGNL injection remote code execution attempt
suricata·2018-09-05
CVE-2018-11776 ET EXPLOIT Apache Struts memberAccess and opensymphony inbound OGNL injection remote code execution attempt
ET EXPLOIT Apache Struts memberAccess and opensymphony inbound OGNL injection remote code execution attempt
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Apache Struts memberAccess and opensymphony inbound OGNL injection remote code execution attempt"; flow:established,to_server; http.uri; content:"|23|_memberAccess"; fast_pattern; content:"com|2E|opensymphony"; nocase; reference:cve,2018-11776; classtype:attempted-admin; sid:2026095; rev:4; metadata:affected_product Apache_Struts2, attack_target Server, created_at 2018_09_05, cve CVE_2018_11776, deployment Datacenter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_07, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190,
Suricata
ET WEB_SPECIFIC_APPS Apache Struts inbound .getClass OGNL injection remote code execution attempt
suricata·2018-08-24
CVE-2018-11776 ET WEB_SPECIFIC_APPS Apache Struts inbound .getClass OGNL injection remote code execution attempt
ET WEB_SPECIFIC_APPS Apache Struts inbound .getClass OGNL injection remote code execution attempt
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Apache Struts inbound .getClass OGNL injection remote code execution attempt"; flow:established,to_server; http.uri; content:"${"; content:".getClass"; distance:0; fast_pattern; reference:cve,2018-11776; classtype:attempted-admin; sid:2026034; rev:3; metadata:affected_product Apache_Struts2, attack_target Server, created_at 2018_08_24, cve CVE_2018_11776, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_07, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facin
Suricata
ET WEB_SPECIFIC_APPS Apache Struts inbound .getWriter OGNL injection remote code execution attempt
suricata·2018-08-24
CVE-2018-11776 ET WEB_SPECIFIC_APPS Apache Struts inbound .getWriter OGNL injection remote code execution attempt
ET WEB_SPECIFIC_APPS Apache Struts inbound .getWriter OGNL injection remote code execution attempt
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Apache Struts inbound .getWriter OGNL injection remote code execution attempt"; flow:established,to_server; http.uri; content:"${"; content:".getWriter"; fast_pattern; distance:0; reference:cve,2018-11776; classtype:attempted-admin; sid:2026032; rev:3; metadata:affected_product Apache_Struts2, attack_target Server, created_at 2018_08_24, cve CVE_2018_11776, deployment Datacenter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_07, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_F
Suricata
ET WEB_SPECIFIC_APPS Apache Struts memberAccess inbound OGNL injection remote code execution attempt
suricata·2018-08-24
CVE-2018-11776 ET WEB_SPECIFIC_APPS Apache Struts memberAccess inbound OGNL injection remote code execution attempt
ET WEB_SPECIFIC_APPS Apache Struts memberAccess inbound OGNL injection remote code execution attempt
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Apache Struts memberAccess inbound OGNL injection remote code execution attempt"; flow:established,to_server; threshold:type both, track by_dst, count 1, seconds 60; http.uri; content:"|23|_memberAccess"; fast_pattern; content:"new|20|"; nocase; pcre:"/new\s+(java|org|sun)/i"; reference:cve,2018-11776; classtype:attempted-admin; sid:2026035; rev:5; metadata:affected_product Apache_Struts2, attack_target Client_Endpoint, created_at 2018_08_24, cve CVE_2018_11776, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_07, mitre_tactic_
Suricata
ET WEB_SPECIFIC_APPS Apache Struts ognl inbound OGNL injection remote code execution attempt
suricata·2018-08-24
CVE-2018-11776 ET WEB_SPECIFIC_APPS Apache Struts ognl inbound OGNL injection remote code execution attempt
ET WEB_SPECIFIC_APPS Apache Struts ognl inbound OGNL injection remote code execution attempt
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Apache Struts ognl inbound OGNL injection remote code execution attempt"; flow:established,to_server; http.uri; content:"${"; content:"ognl|2E|"; distance:0; fast_pattern; reference:cve,2018-11776; classtype:attempted-admin; sid:2026031; rev:3; metadata:affected_product Apache_Struts2, attack_target Server, created_at 2018_08_24, cve CVE_2018_11776, deployment Datacenter, confidence High, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_04_18, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Applicat
Suricata
ET WEB_SPECIFIC_APPS Apache Struts java.lang inbound OGNL injection remote code execution attempt
suricata·2018-08-24
CVE-2018-11776 ET WEB_SPECIFIC_APPS Apache Struts java.lang inbound OGNL injection remote code execution attempt
ET WEB_SPECIFIC_APPS Apache Struts java.lang inbound OGNL injection remote code execution attempt
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Apache Struts java.lang inbound OGNL injection remote code execution attempt"; flow:established,to_server; http.uri; content:"${"; content:"java|2E|lang"; distance:0; fast_pattern; reference:cve,2018-11776; classtype:attempted-admin; sid:2026033; rev:3; metadata:affected_product Apache_Struts2, attack_target Server, created_at 2018_08_24, cve CVE_2018_11776, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_07, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Fa
Suricata
ET EXPLOIT Apache Struts RCE CVE-2018-11776 POC M2
suricata·2018-08-23·CVSS 8.1
CVE-2018-11776 [HIGH] ET EXPLOIT Apache Struts RCE CVE-2018-11776 POC M2
ET EXPLOIT Apache Struts RCE CVE-2018-11776 POC M2
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Apache Struts RCE CVE-2018-11776 POC M2"; flow:established,to_server; http.uri; content:"memberAccess"; content:"allowStaticMethodAccess"; distance:0; content:"java.lang.Runtime@getRuntime().exec("; nocase; fast_pattern; distance:0; content:".getInputStream"; content:"java.io.InputStreamReader"; content:"java.io.BufferedReader"; content:".read"; content:"@org.apache.struts2.ServletActionContext@getResponse"; reference:url,github.com/jas502n/St2-057/blob/master/README.md; reference:cve,2018-11776; classtype:attempted-user; sid:2026026; rev:3; metadata:affected_product Apache_Struts2, attack_target Web_Server, created_at 2018_08_23, cve CVE_2018_11776, deployment Perim
Suricata
ET EXPLOIT Apache Struts RCE CVE-2018-11776 POC M1
suricata·2018-08-23·CVSS 8.1
CVE-2018-11776 [HIGH] ET EXPLOIT Apache Struts RCE CVE-2018-11776 POC M1
ET EXPLOIT Apache Struts RCE CVE-2018-11776 POC M1
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Apache Struts RCE CVE-2018-11776 POC M1"; flow:established,to_server; http.uri; content:"memberAccess"; content:"allowStaticMethodAccess"; distance:0; content:"java.lang.Runtime|25|40getRuntime().exec("; nocase; fast_pattern; distance:0; content:".getInputStream()"; content:"java.io.InputStreamReader("; content:"java.io.BufferedReader("; content:".read("; content:"org.apache.struts2.ServletActionContext"; content:"getResponse().getWriter()"; reference:url,github.com/jas502n/St2-057/blob/master/README.md; reference:cve,2018-11776; classtype:attempted-user; sid:2026025; rev:3; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_
Exploit-DB
Apache Struts 2 - Namespace Redirect OGNL Injection (Metasploit)
exploitdb·2018-09-10·CVSS 8.1
CVE-2018-11776 [HIGH] Apache Struts 2 - Namespace Redirect OGNL Injection (Metasploit)
Apache Struts 2 - Namespace Redirect OGNL Injection (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'Apache Struts 2 Namespace Redirect OGNL Injection',
'Description' => %q{
This module exploits a remote code execution vulnerability in Apache Struts
version 2.3 - 2.3.4, and 2.5 - 2.5.16. Remote Code Execution can be performed
via an endpoint that makes use of a redirect action.
Native payloads will be converted to executables and dropped in the
server's temp dir. If this fails, try a cmd/* payload, which won't
have to write to the disk.
},
#TODO: Is that second paragraph above still accurate?
'Author' => [
'Man Yue Mo', # Discovery
'hook-s3c', # PoC
'asoto-r
Exploit-DB
Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (1)
exploitdb·2018-08-26·CVSS 8.1
CVE-2018-11776 [HIGH] Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (1)
Apache Struts 2.3
# This code uses a payload from:
# https://github.com/jas502n/St2-057
# *****************************************************
import argparse
import random
import requests
import sys
try:
from urllib import parse as urlparse
except ImportError:
import urlparse
# Disable SSL warnings
try:
import requests.packages.urllib3
requests.packages.urllib3.disable_warnings()
except Exception:
pass
if len(sys.argv) " + str(e))
continue
if "Location" in resp.headers.keys():
if str(multiplication_value) in resp.headers['Location']:
print("[*] Status: Vulnerable!")
return(injection_point)
print("[*] Status: Not Affected.")
return(None)
def exploit(url, cmd):
parsed_url = parse_url(url)
injection_point = check(url)
if injection_point is None:
print("[%] Target is not vulnerable.")
Exploit-DB
Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (2)
exploitdb·2018-08-25
CVE-2018-11776 Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (2)
Apache Struts 2.3 ' % sys.argv[0])
else:
exploit(sys.argv[1],sys.argv[2])
Nuclei
Apache Struts2 S2-057 - Remote Code Execution
nuclei·CVSS 8.1
CVE-2018-11776 [HIGH] Apache Struts2 S2-057 - Remote Code Execution
Apache Struts2 S2-057 - Remote Code Execution
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible remote code execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn''t have value and action set and in same time, its upper package have no or wildcard namespace.
Template:
id: CVE-2018-11776
info:
name: Apache Struts2 S2-057 - Remote Code Execution
author: pikpikcu
severity: high
description: |
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible remote code execution when alwaysSelectFullNamespace is true (either by
Metasploit
Apache Struts 2 Namespace Redirect OGNL Injection
metasploit
Apache Struts 2 Namespace Redirect OGNL Injection
Apache Struts 2 Namespace Redirect OGNL Injection
This module exploits a remote code execution vulnerability in Apache Struts version 2.3 - 2.3.4, and 2.5 - 2.5.16. Remote Code Execution can be performed via an endpoint that makes use of a redirect action. Note that this exploit is dependant on the version of Tomcat running on the target. Versions of Tomcat starting with 7.0.88 currently don't support payloads larger than ~7.5kb. Windows Meterpreter sessions on Tomcat >=7.0.88 are currently not supported. Native payloads will be converted to executables and dropped in the server's temp dir. If this fails, try a cmd/* payload, which won't have to write to the disk.
Greynoiseio
Coordinated Cloud-Based Scanning Operation Targets 75 Known Exposure Points in One Day
blogs_greynoiseio·2025-05-27
Coordinated Cloud-Based Scanning Operation Targets 75 Known Exposure Points in One Day
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Trendmicro
Linux-Systeme häufig unter Beschuss
blogs_trendmicro·2023-09-07·CVSS 9.8
[CRITICAL] Linux-Systeme häufig unter Beschuss
Cyberbedrohungen
## Linux-Systeme häufig unter Beschuss
Linux-Report: Alte Sicherheitslücken und neue Technologie stellen Hauptursache für Malware-Infektionen in den Systemen dar. Ransomware-Angriffe häufen sich, aber auch Kryptowährungs-Miner, Webshell-Angriffe und Rootkits.
By: Pawan Kinger Sep 07, 2023 Read time: ( words)
Save to Folio
Linux erfreut sich immer größerer Beliebtheit in der IT-Welt. Vor allem auf Web-Servern und in Rahmen von Embedded-Systemen greifen Unternehmen in der Regel zum Open-Source-Betriebssystem. So laufen etwa 81 Prozent aller Webseiten über Linux und 90 Prozent aller Public-Cloud-Workloads werden mit der Open-Source-Alternative betrieben. Apache, Nginx und viele Dienste auf Amazon Web Services (AWS) sind nur ein kleiner Auszug von populären Linux-basierte
Qualys
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
blogs_qualys·2022-02-23
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
#### Table of Contents
- Situation
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISA Vulnerabilities Using Qualys VMDR
- CISA Exploited RTI
- Detailed Operational Dashboard
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
CISA released a directive in November 2021, recommending urgent and prioritized remediation of actively exploited vulnerabilities. Both government agencies and corporations should heed this advice. This blog outlines how Qualys Vulnerability Management, Detection & Response can be used by any organization to respond to this directive efficiently and effectively.
## Situation
Last November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directiv
Talos
Connecting the dots between recently active cryptominers
blogs_talos·2018-12-18
Connecting the dots between recently active cryptominers
Post authored by David Liebenberg and Andrew Williams.
### Executive Summary Through Cisco Talos' investigation of illicit cryptocurrency mining campaigns in the past year, we began to notice that many of these campaigns shared remarkably similar TTPs, which we at first mistakenly interpreted as being attributed to a single actor. However, closer analysis revealed that a spate of illicit mining activity over the past year could be attributed to several actors that have netted them hundreds of thousands of U.S. dollars combined.
This blog examines these actors' recent campaigns, connects them to other public investigations and examines commonalities among their toolsets and methodologies.
We will cover the recent activities of these actors:
- Rocke —A group that employs Git repositories
Tenable
Cisco Critical Advisories for September Includes Patch for Struts Vulnerability
blogs_tenable·2018-09-05·CVSS 8.1
CVE-2018-11776 [HIGH] Cisco Critical Advisories for September Includes Patch for Struts Vulnerability
Blog / Cyber Exposure Alerts
Subscribe
# Cisco Critical Advisories for September Includes Patch for Struts Vulnerability
Satnam Narang
September 5, 2018
2 Min Read
Cisco has released advisories for 29 issues, including three critical vulnerabilities. The update also includes a patch for CVE-2018-11776 in Apache Struts.
### Background
On Wednesday, September 5, Cisco released security advisories for 29 issues, rating three of them as critical. One of these critical vulnerabilities is the Apache Struts vulnerability (CVE-2018-11776) that we wrote about last month. The other two critical vulnerabilities affect Cisco’s Umbrella API (CVE-2018-0435) and several Cisco wireless VPN devices (CVE-2018-0423).
### Vulnerability details
While exploitation of the Struts vulnerability is the sam
Tenable
Cisco Critical Advisories for September Includes Patch for Struts Vulnerability
blogs_tenable·2018-09-05
Cisco Critical Advisories for September Includes Patch for Struts Vulnerability
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Volexity
Active Exploitation of New Apache Struts Vulnerability CVE-2018-11776 Deploys Cryptocurrency Miner
blogs_volexity·2018-08-27·CVSS 8.1
CVE-2018-11776 [HIGH] Active Exploitation of New Apache Struts Vulnerability CVE-2018-11776 Deploys Cryptocurrency Miner
Threat Intelligence
# Active Exploitation of New Apache Struts Vulnerability CVE-2018-11776 Deploys Cryptocurrency Miner
August 27, 2018
Matthew Meltzer, Sean Koessel, and Steven Adair
On Wednesday, August 22, 2018, the Apache Foundation released a security bulletin for a critical vulnerability in the Apache Struts framework. This bulletin stated that the vulnerability, assigned CVE-2018-11776, could potentially allow for remote code execution if successfully exploited. Only a day later, on August 23, 2018, a researcher released a proof of concept (PoC) exploit for this vulnerability.
- https://github.com/jas502n/St2-057/blob/master/README.md
On August 24, 2018, a Python script was released to make use of the exploit:
- https://github.com/pr4jwal/quick-scripts/blob/master/s2-057.py
Volexity
Active Exploitation of New Apache Struts Vulnerability CVE-2018-11776 Deploys Cryptocurrency Miner
blogs_volexity·2018-08-27·CVSS 8.1
CVE-2018-11776 [HIGH] Active Exploitation of New Apache Struts Vulnerability CVE-2018-11776 Deploys Cryptocurrency Miner
Threat Intelligence
## Active Exploitation of New Apache Struts Vulnerability CVE-2018-11776 Deploys Cryptocurrency Miner
August 27, 2018
Matthew Meltzer, Sean Koessel, and Steven Adair
On Wednesday, August 22, 2018, the Apache Foundation released a security bulletin for a critical vulnerability in the Apache Struts framework. This bulletin stated that the vulnerability, assigned CVE-2018-11776 , could potentially allow for remote code execution if successfully exploited. Only a day later, on August 23, 2018, a researcher released a proof of concept (PoC) exploit for this vulnerability.
https://github.com/jas502n/St2-057/blob/master/README.md
On August 24, 2018, a Python script was released to make use of the exploit:
https://github.com/pr4jwal/quick-scripts/blob/master/s2-057.py
S
Qualys
Security News: Ransomware, Struts Bug, Android Spyware | Qualys
blogs_qualys·2018-08-27·CVSS 8.1
CVE-2018-11776 [HIGH] Security News: Ransomware, Struts Bug, Android Spyware | Qualys
Ransomware raids aimed at specific targets with big pockets. Another Struts vulnerability — but scarier than last year’s. An Android spyware that records your phone calls. These are some of the security news that have caught our attention.
### New Struts Bug Should Be Patched Yesterday
Apache patched a serious remote code execution vulnerability (CVE-2018-11776) affecting all supported versions — 2.3 to 2.3.34 and 2.5 to 2.5.16 — of the widely used Struts Java application framework. The bug is considered more dangerous than the one disclosed last year in Struts that was exploited in the massive data breach at Equifax.
In the Apache security bulletin, the vulnerability is rated “Critical” and users are advised to immediately upgrade to Struts 2.3.35 or Struts 2.5.17.
The remote code exe
Qualys
Security News: Hackers Aim Ransomware at Big Cos., as Experts Call for Swift Patching of Struts Bug
blogs_qualys·2018-08-27·CVSS 8.1
CVE-2018-11776 [HIGH] Security News: Hackers Aim Ransomware at Big Cos., as Experts Call for Swift Patching of Struts Bug
Ransomware raids aimed at specific targets with big pockets. Another Struts vulnerability — but scarier than last year’s. An Android spyware that records your phone calls. These are some of the security news that have caught our attention.
## New Struts Bug Should Be Patched Yesterday
Apache patched a serious remote code execution vulnerability ( CVE-2018-11776 ) affecting all supported versions — 2.3 to 2.3.34 and 2.5 to 2.5.16 — of the widely used Struts Java application framework. The bug is considered more dangerous than the one disclosed last year in Struts that was exploited in the massive data breach at Equifax.
In the Apache security bulletin , the vulnerability is rated “Critical” and users are advised to immediately upgrade to Struts 2.3.35 or Struts 2.5.17.
The remote code e
Unit42
Threat Brief: Information on Critical Apache Struts Vulnerability CVE-2018-11776
blogs_unit42·2018-08-24·CVSS 8.8
CVE-2018-11776 [HIGH] Threat Brief: Information on Critical Apache Struts Vulnerability CVE-2018-11776
Situation Overview
On August 22, 2018, the Apache Foundation released a critical security update for CVE-2018-1176, a remote code execution vulnerability affecting Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16. The Apache Foundation has urged everyone to apply the security updates as soon as possible.
This blog is to provide information to help organizations assess their risk of the vulnerability and to inform Palo Alto Networks customers of protections in place that can help mitigate their risk until they can apply the security updates. Palo Alto Networks customers who have deployed the latest vulnerability signatures released on August 24, 2018, are protected.
Vulnerability Information
According to both the Apache Foundation and security researcher Man Yue Mo, this vulnerabi
Unit42
Threat Brief: Information on Critical Apache Struts Vulnerability CVE-2018-11776
blogs_unit42·2018-08-24·CVSS 8.8
CVE-2018-11776 [HIGH] Threat Brief: Information on Critical Apache Struts Vulnerability CVE-2018-11776
## Threat Brief: Information on Critical Apache Struts Vulnerability CVE-2018-11776
Unit 42
Published: August 24, 2018
High Profile Threats
Vulnerabilities
Apache
CVE-2018-11776
Protections
Struts
Situation Overview
On August 22, 2018, the Apache Foundation released a critical security update for CVE-2018-1176 , a remote code execution vulnerability affecting Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16. The Apache Foundation has urged everyone to apply the security updates as soon as possible.
This blog is to provide information to help organizations assess their risk of the vulnerability and to inform Palo Alto Networks customers of protections in place that can help mitigate their risk until they can apply the security updates. Palo Alto Networks customers who have d
Qualys
Detecting Apache Struts 2 Namespace RCE: CVE-2018-11776
blogs_qualys·2018-08-23·CVSS 8.1
CVE-2018-11776 [HIGH] Detecting Apache Struts 2 Namespace RCE: CVE-2018-11776
## Table of Contents
The Vulnerability
Recommended Response
Detections
Protection
A new remote code execution vulnerability in Apache Struts 2, CVE-2018-11776, was disclosed yesterday. While this vulnerability does not exist with a default configuration of Struts, it does exist in commonly seen configurations for some Struts plugins.
Update August 24, 2018 : A dashboard for this vulnerability is now available to download.
## The Vulnerability
Struts improperly validates namespaces , allowing for OGNL injection, and can lead to full remote code execution on the target system. For a more detailed technical look at the vulnerability, please see our Threat Protection blog on this topic. Struts versions 2.3.34 and 2.5.16 and before are impacted.
## Recommended Response
Due to the ease
Qualys
Detecting Apache Struts 2 Namespace RCE | Qualys
blogs_qualys·2018-08-23·CVSS 8.1
CVE-2018-11776 [HIGH] Detecting Apache Struts 2 Namespace RCE | Qualys
#### Table of Contents
- The Vulnerability
- Recommended Response
- Detections
- Protection
A new remote code execution vulnerability in Apache Struts 2, CVE-2018-11776, was disclosed yesterday. While this vulnerability does not exist with a default configuration of Struts, it does exist in commonly seen configurations for some Struts plugins.
Update August 24, 2018: A dashboard for this vulnerability is now available to download.
## The Vulnerability
Struts improperly validates namespaces, allowing for OGNL injection, and can lead to full remote code execution on the target system. For a more detailed technical look at the vulnerability, please see our Threat Protection blog on this topic. Struts versions 2.3.34 and 2.5.16 and before are impacted.
## Recommended Response
Due to the
Tenable
New Apache Struts Vulnerability Could Allow for Remote Code Execution
blogs_tenable·2018-08-22
New Apache Struts Vulnerability Could Allow for Remote Code Execution
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
New Apache Struts Vulnerability Could Allow for Remote Code Execution
blogs_tenable·2018-08-22·CVSS 9.8
[CRITICAL] New Apache Struts Vulnerability Could Allow for Remote Code Execution
Blog / Cyber Exposure Alerts
Subscribe
# New Apache Struts Vulnerability Could Allow for Remote Code Execution
Ryan Seguin
August 22, 2018
5 Min Read
Updated August 23: A working proof of concept (PoC) has been discovered and verified on Github by Tenable’s research team. In addition, there are indications that attackers are already probing for vulnerable Apache Struts instances.
## Background
Semmle researchers discovered and disclosed a remote code execution (RCE) vulnerability (CVE-2018-11776) in servers running Apache Struts that meet specific configuration requirements. According to Semmle, those requirements are:
- The alwaysSelectFullNamespace flag is set to true in the Struts configuration. (Note: this is automatically the case if your application uses the popular Struts Co
arXiv
Towards Agentic Honeynet Configuration
arxiv_fulltext·2026-03-14
Towards Agentic Honeynet Configuration
Towards Agentic Honeynet Configuration
Federico Mirra, Matteo Boffa, Danilo Giordano, Marco Mellia
Politecnico di Torino
\first.last\@polito.it
Idilio Drago
Università di Torino
[email protected]
## Abstract
Honeypots are deception systems that emulate vulnerable services to collect threat intelligence. While deploying many honeypots increases the opportunity to observe attacker behaviour, in practise network and computational resources limit the number of honeypots that can be exposed. Hence, practitioners must select the assets to deploy, a decision that is typically made statically despite attacker’ tactics evolving over time.
This work investigates an AI-driven agentic architecture that autonomously manages honeypot exposure in response to ongoing attacks. The proposed agent
arXiv
Do Chase Your Tail! Missing Key Aspects Augmentation in Textual Vulnerability Descriptions of Long-tail Software through Feature Inference
arxiv_fulltext·2024-12-15
Do Chase Your Tail! Missing Key Aspects Augmentation in Textual Vulnerability Descriptions of Long-tail Software through Feature Inference
Do Chase Your Tail! Missing Key Aspects Augmentation in Textual Vulnerability Descriptions of Long-tail Software through Feature Inference
Linyi Han, Shidong Pan, Zhenchang Xing, Jiamou Sun, Sofonias Yitagesu, Xiaowang Zhang, Zhiyong Feng
Manuscript received XXX XXX, 20XX. (Corresponding author: Xiaowang Zhang)
Linyi Han, Sofonias Yitagesu, Xiaowang Zhang, and Zhiyong Feng are with the College of Intelligence and Computing, Tianjin University, Tianjin, China. e-mail: \hanly2, xiaowangzhang, zyfeng\@tju.edu.cn and [email protected].
Shidong Pan, Zhenchang Xing, and Jiamou Sun are with the CSIRO's Data61, Canberra, Australia. e-mail: \Shidong.Pan, Zhenchang.Xing, Frank.Sun\@data61.csiro.au
Linyi Han is also the Center of National Railway Intelligent Transportation System Engineeri
arXiv
Understanding the Quality of Container Security Vulnerability Detection Tools
arxiv_fulltext·2021-01-11
Understanding the Quality of Container Security Vulnerability Detection Tools
Understanding the Quality of Container Security Vulnerability Detection Tools
Omar Javed1 and Salman Toor2,
1Universit\`a della svizzera italiana, Lugano, Switzerland
\omar.javed\@usi.com
2Uppsala University, Uppsala, Sweden
\salman.toor\@it.uu.se
plain
plain
## Abstract
Virtualization enables information and communications technology industry to better manage computing resources. In this regard, improvements in virtualization approaches together with the need for consistent runtime environment, lower overhead and smaller package size has led to the growing adoption of containers. This is a technology, which packages an application, its dependencies and Operating System (OS) to run as an isolated unit. However, the pressing concern with the use of containers is its susceptibility to
arXiv
ATTACK2VEC: Leveraging Temporal Word Embeddings to Understand the Evolution of Cyberattacks
arxiv_fulltext·2019-05-29
ATTACK2VEC: Leveraging Temporal Word Embeddings to Understand the Evolution of Cyberattacks
: Leveraging Temporal Word Embeddings to
Understand the Evolution of Cyberattacks
## Abstract
Despite the fact that cyberattacks are constantly growing in complexity, the research community still lacks effective tools to easily monitor and understand them.
In particular, there is a need for techniques that are able to not only track how prominently certain malicious actions, such as the exploitation of specific vulnerabilities, are exploited in the wild, but also (and more importantly) how these malicious actions factor in as attack steps in more complex cyberattacks.
In this paper we present , a system that uses temporal word embeddings to model how attack steps are exploited in the wild, and track how they evolve.
We test on a dataset of billions of security events collected from the c
CTF
20180908-hackitctf / README
ctf_writeups·2018
20180908-hackitctf / README
# HackIT CTF 2018
**It's recommended to read our responsive [web version](https://balsn.tw/ctf_writeup/20180908-hackitctf/) of this writeup.**
- [HackIT CTF 2018](#hackit-ctf-2018)
- [Welcome](#welcome)
- [Get Going](#get-going)
- [Web](#web)
- [Republic of Gayming](#republic-of-gayming)
- [Believer Case](#believer-case)
- [PeeHPee2](#peehpee2)
- [Reverse](#reverse)
- [coffee_overflow](#coffee_overflow)
## Welcome
### Get Going
(bookgin)
Actually, this should be a welcome challenge, but lots of teams find it not trivial. In the end the organizer releases 2 hints abount this welcome challenges, and directly indicates this is Zero Width Concept. lol
The flag is encoded in Zero Width content with [zwsp-steg-js](https://github.com/offdev/zwsp-steg-js).
```
Welcome to the HackIT 2018
Bugzilla
CVE-2018-11776 struts2: Using specific results and namespaces can result in a remote code execution
bugzilla·2018-08-22·CVSS 8.1
CVE-2018-11776 [HIGH] CVE-2018-11776 struts2: Using specific results and namespaces can result in a remote code execution
CVE-2018-11776 struts2: Using specific results and namespaces can result in a remote code execution
It is possible to perform a RCE attack when namespace value isn't set for a result defined in underlying xml configurations and in same time, its upper action(s) configurations have no or wildcard namespace. Same possibility when using url tag which doesn’t have value and action set and in same time, its upper action(s) configurations have no or wildcard namespace.
External References:
https://cwiki.apache.org/confluence/display/WW/S2-057
Discussion:
Statement:
A previous statement by Red Hat related to this CVE, prior to August 2019, said that Apache Struts 2 is not included in any Red Hat products. This earlier statement was incorrect. While Struts 2 is not actively compiled, shipped
http://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.htmlhttp://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txthttp://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlhttp://www.securityfocus.com/bid/105125http://www.securitytracker.com/id/1041547http://www.securitytracker.com/id/1041888https://cwiki.apache.org/confluence/display/WW/S2-057https://github.com/hook-s3c/CVE-2018-11776-Python-PoChttps://lgtm.com/blog/apache_struts_CVE-2018-11776https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3Ehttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0012https://security.netapp.com/advisory/ntap-20180822-0001/https://security.netapp.com/advisory/ntap-20181018-0002/https://www.exploit-db.com/exploits/45260/https://www.exploit-db.com/exploits/45262/https://www.exploit-db.com/exploits/45367/https://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlhttp://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.htmlhttp://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txthttp://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlhttp://www.securityfocus.com/bid/105125http://www.securitytracker.com/id/1041547http://www.securitytracker.com/id/1041888https://cwiki.apache.org/confluence/display/WW/S2-057https://github.com/hook-s3c/CVE-2018-11776-Python-PoChttps://lgtm.com/blog/apache_struts_CVE-2018-11776https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3Ehttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0012https://security.netapp.com/advisory/ntap-20180822-0001/https://security.netapp.com/advisory/ntap-20181018-0002/https://www.exploit-db.com/exploits/45260/https://www.exploit-db.com/exploits/45262/https://www.exploit-db.com/exploits/45367/https://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-11776
2018-08-22
Published
2021-11-03
Added to CISA KEV
Exploited in the wild