H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Vulnerability

CVE-2018-11776

Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace. Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.

Vulnerability
TypeVulnerability
External ID—
First seen2021-11-03
Last seen2021-11-03

Confidence

—

Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace. Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.

Labels

exploitedkev

CISA KEV context

Vendor / productApache Struts
Added2021-11-03
Due date2022-05-03
52 recorded

Relationships

mitigates
from Remediate CVE-2018-11776
Mitigation
related-to
to Accessing/Intercepting/Modifying HTTP Cookies
Technique
related-to
to AJAX Footprinting
Technique
related-to
to Blind SQL Injection
Technique
related-to
to Buffer Overflow in an API Call
Technique
related-to
to Buffer Overflow in Local Command-Line Utilities
Technique
related-to
to Buffer Overflow via Environment Variables
Technique
related-to
to Buffer Overflow via Parameter Expansion
Technique
related-to
to Buffer Overflow via Symbolic Links
Technique
related-to
to Client-side Injection-induced Buffer Overflow
Technique
related-to
to Command Line Execution through SQL Injection
Technique
related-to
to Cross-Site Scripting (XSS)
Technique
related-to
to Cross Zone Scripting
Technique
related-to
to DOM-Based XSS
Technique
related-to
to Double Encoding
Technique
related-to
to Embedding NULL Bytes
Technique
related-to
to Exploiting Multiple Input Interpretation Layers
Technique
related-to
to Exploiting Trust in Client
Technique
related-to
to File Content Injection
Technique
related-to
to Filter Failure through Buffer Overflow
Technique
related-to
to Flash Injection
Technique
related-to
to Format String Injection
Technique
related-to
to Fuzzing
Technique
related-to
to Fuzzing for garnering other adjacent user/sensitive data
Technique
related-to
to Input Data Manipulation
Technique
related-to
to LDAP Injection
Technique
related-to
to Leverage Alternate Encoding
Technique
related-to
to MIME Conversion
Technique
related-to
to Object Relational Mapping Injection
Technique
related-to
to OS Command Injection
Technique
related-to
to Overflow Variables and Tags
Technique
related-to
to Oversized Serialized Data Payloads
Technique
related-to
to Postfix, Null Terminate, and Backslash
Technique
related-to
to Serialized Data with Nested Payloads
Technique
related-to
to Server Side Include (SSI) Injection
Technique
related-to
to Server Side Request Forgery
Technique
related-to
to Signature Spoof
Technique
related-to
to SQL Injection through SOAP Parameter Tampering
Technique
related-to
to String Format Overflow in syslog()
Technique
related-to
to Subverting Environment Variable Values
Technique
related-to
to URL Encoding
Technique
related-to
to User-Controlled Filename
Technique
related-to
to Using Escaped Slashes in Alternate Encoding
Technique
related-to
to Using Leading 'Ghost' Character Sequences to Bypass Input Filters
Technique
related-to
to Using Slashes and URL Encoding Combined to Bypass Validation Logic
Technique
related-to
to Using Slashes in Alternate Encoding
Technique
related-to
to Using Unicode Encoding to Bypass Validation Logic
Technique
related-to
to Using UTF-8 Encoding to Bypass Validation Logic
Technique
related-to
to Web Server Logs Tampering
Technique
related-to
to XML Injection
Technique
related-to
to XPath Injection
Technique
related-to
to XSS Using MIME Type Mismatch
Technique
2 external

References

nvd
CVE-2018-11776
open
cwe
CWE-20
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance