CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2017-5638

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.943

EPSS Ranking 99.9%

CVSS Severity

CVSS v3 Score 9.8

CVSS v2 Score 10.0

Proposed Action

Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.

Ransomware Campaign

Known

References

Products affected by CVE-2017-5638

Apache » Struts » Version: 2.2.3

cpe:2.3:a:apache:struts:2.2.3
Apache » Struts » Version: 2.2.3.1

cpe:2.3:a:apache:struts:2.2.3.1
Apache » Struts » Version: 2.3.0

cpe:2.3:a:apache:struts:2.3.0
Apache » Struts » Version: 2.3.1

cpe:2.3:a:apache:struts:2.3.1
Apache » Struts » Version: 2.3.1.1

cpe:2.3:a:apache:struts:2.3.1.1
Apache » Struts » Version: 2.3.1.2

cpe:2.3:a:apache:struts:2.3.1.2
Apache » Struts » Version: 2.3.10

cpe:2.3:a:apache:struts:2.3.10
Apache » Struts » Version: 2.3.11

cpe:2.3:a:apache:struts:2.3.11
Apache » Struts » Version: 2.3.12

cpe:2.3:a:apache:struts:2.3.12
Apache » Struts » Version: 2.3.13

cpe:2.3:a:apache:struts:2.3.13
Apache » Struts » Version: 2.3.14

cpe:2.3:a:apache:struts:2.3.14
Apache » Struts » Version: 2.3.14.1

cpe:2.3:a:apache:struts:2.3.14.1
Apache » Struts » Version: 2.3.14.2

cpe:2.3:a:apache:struts:2.3.14.2
Apache » Struts » Version: 2.3.14.3

cpe:2.3:a:apache:struts:2.3.14.3
Apache » Struts » Version: 2.3.15

cpe:2.3:a:apache:struts:2.3.15
Apache » Struts » Version: 2.3.15.1

cpe:2.3:a:apache:struts:2.3.15.1
Apache » Struts » Version: 2.3.15.2

cpe:2.3:a:apache:struts:2.3.15.2
Apache » Struts » Version: 2.3.15.3

cpe:2.3:a:apache:struts:2.3.15.3
Apache » Struts » Version: 2.3.16

cpe:2.3:a:apache:struts:2.3.16
Apache » Struts » Version: 2.3.16.1

cpe:2.3:a:apache:struts:2.3.16.1
Apache » Struts » Version: 2.3.16.2

cpe:2.3:a:apache:struts:2.3.16.2
Apache » Struts » Version: 2.3.16.3

cpe:2.3:a:apache:struts:2.3.16.3
Apache » Struts » Version: 2.3.17

cpe:2.3:a:apache:struts:2.3.17
Apache » Struts » Version: 2.3.19

cpe:2.3:a:apache:struts:2.3.19
Apache » Struts » Version: 2.3.20

cpe:2.3:a:apache:struts:2.3.20
Apache » Struts » Version: 2.3.20.1

cpe:2.3:a:apache:struts:2.3.20.1
Apache » Struts » Version: 2.3.20.2

cpe:2.3:a:apache:struts:2.3.20.2
Apache » Struts » Version: 2.3.20.3

cpe:2.3:a:apache:struts:2.3.20.3
Apache » Struts » Version: 2.3.21

cpe:2.3:a:apache:struts:2.3.21
Apache » Struts » Version: 2.3.22

cpe:2.3:a:apache:struts:2.3.22
Apache » Struts » Version: 2.3.23

cpe:2.3:a:apache:struts:2.3.23
Apache » Struts » Version: 2.3.24

cpe:2.3:a:apache:struts:2.3.24
Apache » Struts » Version: 2.3.24.1

cpe:2.3:a:apache:struts:2.3.24.1
Apache » Struts » Version: 2.3.24.2

cpe:2.3:a:apache:struts:2.3.24.2
Apache » Struts » Version: 2.3.24.3

cpe:2.3:a:apache:struts:2.3.24.3
Apache » Struts » Version: 2.3.25

cpe:2.3:a:apache:struts:2.3.25
Apache » Struts » Version: 2.3.26

cpe:2.3:a:apache:struts:2.3.26
Apache » Struts » Version: 2.3.27

cpe:2.3:a:apache:struts:2.3.27
Apache » Struts » Version: 2.3.28

cpe:2.3:a:apache:struts:2.3.28
Apache » Struts » Version: 2.3.28.1

cpe:2.3:a:apache:struts:2.3.28.1
Apache » Struts » Version: 2.3.29

cpe:2.3:a:apache:struts:2.3.29
Apache » Struts » Version: 2.3.3

cpe:2.3:a:apache:struts:2.3.3
Apache » Struts » Version: 2.3.30

cpe:2.3:a:apache:struts:2.3.30
Apache » Struts » Version: 2.3.31

cpe:2.3:a:apache:struts:2.3.31
Apache » Struts » Version: 2.3.4

cpe:2.3:a:apache:struts:2.3.4
Apache » Struts » Version: 2.3.4.1

cpe:2.3:a:apache:struts:2.3.4.1
Apache » Struts » Version: 2.3.5

cpe:2.3:a:apache:struts:2.3.5
Apache » Struts » Version: 2.3.6

cpe:2.3:a:apache:struts:2.3.6
Apache » Struts » Version: 2.3.7

cpe:2.3:a:apache:struts:2.3.7
Apache » Struts » Version: 2.3.8

cpe:2.3:a:apache:struts:2.3.8
Apache » Struts » Version: 2.3.9

cpe:2.3:a:apache:struts:2.3.9
Apache » Struts » Version: 2.5.0

cpe:2.3:a:apache:struts:2.5.0
Apache » Struts » Version: 2.5.1

cpe:2.3:a:apache:struts:2.5.1
Apache » Struts » Version: 2.5.10

cpe:2.3:a:apache:struts:2.5.10
Apache » Struts » Version: 2.5.2

cpe:2.3:a:apache:struts:2.5.2
Apache » Struts » Version: 2.5.3

cpe:2.3:a:apache:struts:2.5.3
Apache » Struts » Version: 2.5.4

cpe:2.3:a:apache:struts:2.5.4
Apache » Struts » Version: 2.5.5

cpe:2.3:a:apache:struts:2.5.5
Apache » Struts » Version: 2.5.6

cpe:2.3:a:apache:struts:2.5.6
Apache » Struts » Version: 2.5.7

cpe:2.3:a:apache:struts:2.5.7
Apache » Struts » Version: 2.5.8

cpe:2.3:a:apache:struts:2.5.8
Apache » Struts » Version: 2.5.9

cpe:2.3:a:apache:struts:2.5.9
Arubanetworks » Clearpass Policy Manager » Version: N/A

cpe:2.3:a:arubanetworks:clearpass_policy_manager:-
Arubanetworks » Clearpass Policy Manager » Version: 3.0

cpe:2.3:a:arubanetworks:clearpass_policy_manager:3.0
Arubanetworks » Clearpass Policy Manager » Version: 3.0.1

cpe:2.3:a:arubanetworks:clearpass_policy_manager:3.0.1
Arubanetworks » Clearpass Policy Manager » Version: 3.5.1

cpe:2.3:a:arubanetworks:clearpass_policy_manager:3.5.1
Arubanetworks » Clearpass Policy Manager » Version: 4.0

cpe:2.3:a:arubanetworks:clearpass_policy_manager:4.0
Arubanetworks » Clearpass Policy Manager » Version: 5.1

cpe:2.3:a:arubanetworks:clearpass_policy_manager:5.1
Arubanetworks » Clearpass Policy Manager » Version: 5.1.1

cpe:2.3:a:arubanetworks:clearpass_policy_manager:5.1.1
Arubanetworks » Clearpass Policy Manager » Version: 5.2

cpe:2.3:a:arubanetworks:clearpass_policy_manager:5.2
Arubanetworks » Clearpass Policy Manager » Version: 6.0.1

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.0.1
Arubanetworks » Clearpass Policy Manager » Version: 6.0.2

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.0.2
Arubanetworks » Clearpass Policy Manager » Version: 6.1

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.1
Arubanetworks » Clearpass Policy Manager » Version: 6.1.1

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.1.1
Arubanetworks » Clearpass Policy Manager » Version: 6.1.2

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.1.2
Arubanetworks » Clearpass Policy Manager » Version: 6.1.3

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.1.3
Arubanetworks » Clearpass Policy Manager » Version: 6.1.4

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.1.4
Arubanetworks » Clearpass Policy Manager » Version: 6.2.0

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.2.0
Arubanetworks » Clearpass Policy Manager » Version: 6.2.1

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.2.1
Arubanetworks » Clearpass Policy Manager » Version: 6.2.2

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.2.2
Arubanetworks » Clearpass Policy Manager » Version: 6.2.3

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.2.3
Arubanetworks » Clearpass Policy Manager » Version: 6.2.4

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.2.4
Arubanetworks » Clearpass Policy Manager » Version: 6.2.5

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.2.5
Arubanetworks » Clearpass Policy Manager » Version: 6.2.6

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.2.6
Arubanetworks » Clearpass Policy Manager » Version: 6.3.0

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.3.0
Arubanetworks » Clearpass Policy Manager » Version: 6.3.0.60730

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.3.0.60730
Arubanetworks » Clearpass Policy Manager » Version: 6.3.1

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.3.1
Arubanetworks » Clearpass Policy Manager » Version: 6.3.2

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.3.2
Arubanetworks » Clearpass Policy Manager » Version: 6.3.3

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.3.3
Arubanetworks » Clearpass Policy Manager » Version: 6.3.4

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.3.4
Arubanetworks » Clearpass Policy Manager » Version: 6.3.5

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.3.5
Arubanetworks » Clearpass Policy Manager » Version: 6.3.6

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.3.6
Arubanetworks » Clearpass Policy Manager » Version: 6.4.0

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.4.0
Arubanetworks » Clearpass Policy Manager » Version: 6.4.1

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.4.1
Arubanetworks » Clearpass Policy Manager » Version: 6.4.2

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.4.2
Arubanetworks » Clearpass Policy Manager » Version: 6.4.3

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.4.3
Arubanetworks » Clearpass Policy Manager » Version: 6.4.4

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.4.4
Arubanetworks » Clearpass Policy Manager » Version: 6.4.5

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.4.5
Arubanetworks » Clearpass Policy Manager » Version: 6.4.6

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.4.6
Arubanetworks » Clearpass Policy Manager » Version: 6.4.7

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.4.7
Arubanetworks » Clearpass Policy Manager » Version: 6.5.0

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.5.0
Arubanetworks » Clearpass Policy Manager » Version: 6.5.1

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.5.1
Arubanetworks » Clearpass Policy Manager » Version: 6.5.2

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.5.2
Arubanetworks » Clearpass Policy Manager » Version: 6.5.3

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.5.3
Arubanetworks » Clearpass Policy Manager » Version: 6.5.4

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.5.4
Arubanetworks » Clearpass Policy Manager » Version: 6.5.5

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.5.5
Arubanetworks » Clearpass Policy Manager » Version: 6.5.6

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.5.6
Arubanetworks » Clearpass Policy Manager » Version: 6.5.7

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.5.7
Arubanetworks » Clearpass Policy Manager » Version: 6.6.0

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.6.0
Arubanetworks » Clearpass Policy Manager » Version: 6.6.1

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.6.1
Arubanetworks » Clearpass Policy Manager » Version: 6.6.2

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.6.2
Arubanetworks » Clearpass Policy Manager » Version: 6.6.3

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.6.3
Arubanetworks » Clearpass Policy Manager » Version: 6.6.4

cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.6.4
Hp » Server Automation » Version: 10.0.0

cpe:2.3:a:hp:server_automation:10.0.0
Hp » Server Automation » Version: 10.1.0

cpe:2.3:a:hp:server_automation:10.1.0
Hp » Server Automation » Version: 10.2.0

cpe:2.3:a:hp:server_automation:10.2.0
Hp » Server Automation » Version: 10.5.0

cpe:2.3:a:hp:server_automation:10.5.0
Hp » Server Automation » Version: 9.1.0

cpe:2.3:a:hp:server_automation:9.1.0
Netapp » Oncommand Balance » Version: N/A

cpe:2.3:a:netapp:oncommand_balance:-
Oracle » Weblogic Server » Version: 10.3.6.0.0

cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0
Oracle » Weblogic Server » Version: 12.1.3.0.0

cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0
Oracle » Weblogic Server » Version: 12.2.1.1.0

cpe:2.3:a:oracle:weblogic_server:12.2.1.1.0
Oracle » Weblogic Server » Version: 12.2.1.2.0

cpe:2.3:a:oracle:weblogic_server:12.2.1.2.0
Ibm » Storwize V3500 » Version: N/A

cpe:2.3:h:ibm:storwize_v3500:-
Ibm » Storwize V5000 » Version: N/A

cpe:2.3:h:ibm:storwize_v5000:-
Ibm » Storwize V7000 » Version: N/A

cpe:2.3:h:ibm:storwize_v7000:-
Lenovo » Storage V5030 » Version: N/A

cpe:2.3:h:lenovo:storage_v5030:-
Ibm » Storwize V3500 Firmware » Version: 7.7.1.6

cpe:2.3:o:ibm:storwize_v3500_firmware:7.7.1.6
Ibm » Storwize V3500 Firmware » Version: 7.8.1.0

cpe:2.3:o:ibm:storwize_v3500_firmware:7.8.1.0
Ibm » Storwize V5000 Firmware » Version: 7.7.1.6

cpe:2.3:o:ibm:storwize_v5000_firmware:7.7.1.6
Ibm » Storwize V5000 Firmware » Version: 7.8.1.0

cpe:2.3:o:ibm:storwize_v5000_firmware:7.8.1.0
Ibm » Storwize V7000 Firmware » Version: 7.7.1.6

cpe:2.3:o:ibm:storwize_v7000_firmware:7.7.1.6
Ibm » Storwize V7000 Firmware » Version: 7.8.1.0

cpe:2.3:o:ibm:storwize_v7000_firmware:7.8.1.0
Lenovo » Storage V5030 Firmware » Version: 7.7.1.6

cpe:2.3:o:lenovo:storage_v5030_firmware:7.7.1.6
Lenovo » Storage V5030 Firmware » Version: 7.8.1.0

cpe:2.3:o:lenovo:storage_v5030_firmware:7.8.1.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2017-5638

Products

Pricing

Contact Us