## Summary
Possible Remote Code Execution when using results with no `namespace` and in same time, its upper action(s) have no or wildcard `namespace`. Same possibility when using `url` tag which doesn’t have `value` and `action` set.
| Who should read this | All Struts 2 developers and users |
| ----------------------- | ------------------------------------------------------------ |
| Impact of vulnerability | Possible Remote Code Execution when using results with no `namespace` and in same time, its upper action(s) have no or wildcard `namespace`. Same possibility when using `url` tag which doesn’t have `value` and `action` set. |
| Maximum security rating | Critical |
| Affected Software | Struts 2.3 - Struts 2.3.34, Struts 2.5 - Struts 2.5.16The unsupported Struts versions may be also affected |
| Reporter | Man Yue Mo from the Semmle Security Research team |
| CVE Identifier | CVE-2018-11776 |
## Problem
It is possible to perform a RCE attack when `namespace` value isn't set for a result defined in underlying xml configurations and in same time, its upper action(s) configurations have no or wildcard `namespace`. Same possibility when using `url` tag which doesn’t have `value` and `action` set and in same time, its upper action(s) configurations have no or wildcard `namespace`.
## Solution
Upgrade to Apache Struts version 2.3.35 or 2.5.17.
## Backward compatibility
Both 2.3.35 and 2.5.17 versions contain the security fixes only, nothing more. No backward incompatibility issues are expected.
zy66
M茗
匿名
racobox
京公网安备 11010502034610号
全部评论 (2)