CVE-2017-5638

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-5638
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-5638.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-5638
Aliases
Published
2017-03-11T02:59:00.150Z
Modified
2026-07-08T05:50:03.837773344Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Database specific 
{
    "unresolved_ranges": [
        {
            "vendor_product": "arubanetworks:clearpass_policy_manager",
            "cpes": [
                "cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "fixed": "6.6.5"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "vendor_product": "hp:server_automation",
            "cpes": [
                "cpe:2.3:a:hp:server_automation:10.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:hp:server_automation:10.1.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:hp:server_automation:10.2.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:hp:server_automation:10.5.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:hp:server_automation:9.1.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "9.1.0"
                },
                {
                    "last_affected": "9.1.0"
                },
                {
                    "introduced": "10.0.0"
                },
                {
                    "last_affected": "10.0.0"
                },
                {
                    "introduced": "10.1.0"
                },
                {
                    "last_affected": "10.1.0"
                },
                {
                    "introduced": "10.2.0"
                },
                {
                    "last_affected": "10.2.0"
                },
                {
                    "introduced": "10.5.0"
                },
                {
                    "last_affected": "10.5.0"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "vendor_product": "ibm:storwize_v3500_firmware",
            "cpes": [
                "cpe:2.3:o:ibm:storwize_v3500_firmware:7.7.1.6:*:*:*:*:*:*:*",
                "cpe:2.3:o:ibm:storwize_v3500_firmware:7.8.1.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "7.7.1.6"
                },
                {
                    "last_affected": "7.7.1.6"
                },
                {
                    "introduced": "7.8.1.0"
                },
                {
                    "last_affected": "7.8.1.0"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "vendor_product": "ibm:storwize_v5000_firmware",
            "cpes": [
                "cpe:2.3:o:ibm:storwize_v5000_firmware:7.7.1.6:*:*:*:*:*:*:*",
                "cpe:2.3:o:ibm:storwize_v5000_firmware:7.8.1.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "7.7.1.6"
                },
                {
                    "last_affected": "7.7.1.6"
                },
                {
                    "introduced": "7.8.1.0"
                },
                {
                    "last_affected": "7.8.1.0"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "vendor_product": "ibm:storwize_v7000_firmware",
            "cpes": [
                "cpe:2.3:o:ibm:storwize_v7000_firmware:7.7.1.6:*:*:*:*:*:*:*",
                "cpe:2.3:o:ibm:storwize_v7000_firmware:7.8.1.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "7.7.1.6"
                },
                {
                    "last_affected": "7.7.1.6"
                },
                {
                    "introduced": "7.8.1.0"
                },
                {
                    "last_affected": "7.8.1.0"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "vendor_product": "lenovo:storage_v5030_firmware",
            "cpes": [
                "cpe:2.3:o:lenovo:storage_v5030_firmware:7.7.1.6:*:*:*:*:*:*:*",
                "cpe:2.3:o:lenovo:storage_v5030_firmware:7.8.1.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "extracted_events": [
                {
                    "introduced": "7.7.1.6"
                },
                {
                    "last_affected": "7.7.1.6"
                },
                {
                    "introduced": "7.8.1.0"
                },
                {
                    "last_affected": "7.8.1.0"
                }
            ]
        },
        {
            "vendor_product": "oracle:weblogic_server",
            "cpes": [
                "cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:weblogic_server:12.2.1.1.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:weblogic_server:12.2.1.2.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "10.3.6.0.0"
                },
                {
                    "last_affected": "10.3.6.0.0"
                },
                {
                    "introduced": "12.1.3.0.0"
                },
                {
                    "last_affected": "12.1.3.0.0"
                },
                {
                    "introduced": "12.2.1.1.0"
                },
                {
                    "last_affected": "12.2.1.1.0"
                },
                {
                    "introduced": "12.2.1.2.0"
                },
                {
                    "last_affected": "12.2.1.2.0"
                }
            ],
            "source": "CPE_STRING"
        }
    ]
}
References

Affected packages

Git / github.com/apache/struts

Affected ranges

Type
GIT
Repo
https://github.com/apache/struts
Events
Introduced
c80cb8458966e10d88a192b5ce68e47aee0e944a
Fixed
1ed29d508fc0a3762ad7d16336a71adcf69bd88d
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
376a891aeed6157d5621f9a9101d91be60f57b01
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "2.2.3"
        },
        {
            "fixed": "2.3.32"
        },
        {
            "introduced": "2.5.0"
        },
        {
            "fixed": "2.5.10.1"
        }
    ]
}

Affected versions

Other
STRUTS_2_3_24
STRUTS_2_3_24_1
STRUTS_2_3_25
STRUTS_2_3_26
STRUTS_2_3_27
STRUTS_2_3_28
STRUTS_2_3_29
STRUTS_2_3_30
STRUTS_2_3_31
STRUTS_2_5_10
STRUTS_2_5_3
STRUTS_2_5_4
STRUTS_2_5_5
STRUTS_2_5_6
STRUTS_2_5_7
STRUTS_2_5_8
STRUTS_2_5_9
STRUTS_2_5_BETA1
STRUTS_2_5_BETA2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-5638.json"