CVE-2017-12611

Critical

Published: 20/09/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In Apache Struts versions 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a remote code execution (RCE) attack.

Risk Assessment

Organizations using vulnerable versions of Apache Struts may be exposed to attacks that allow remote code execution, potentially leading to serious security breaches.

Recommendation

It is recommended to upgrade to the latest version of Apache Struts to mitigate this vulnerability and review the code to eliminate unintentional expressions in Freemarker tags.

Original NVD description (English source)

In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.