Skip to content
fr Sign in
9.8 Critical Exploited · ransomware

CVE-2017-5638 Apache Struts Remote Code Execution Vulnerability

Active exploitation observed

· CISA KEV catalogue
Required action Apply updates per vendor instructions.
Ransomware campaigns Known to be used
Weakness CWE-20

Description

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Affected products and versions

Product Affected versions Fixed in
Apache Struts Versions not published

References

Timeline

  1. Published
  2. Added to the KEV catalogue
  3. Last modified

Other CVEs of Apache Struts

The 33 CVEs of Apache Struts →
CVE-2026-104714 Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache… Not rated CVE-2026-104713 Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin Not rated CVE-2026-104712 Asymmetric resource consumption (amplification) vulnerability in Apache Struts Not rated CVE-2026-104711 Improper neutralization of special elements used in an expression language statement ('Expression Language Injection')… Not rated
Track this CVE