Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2017-5638 Details

Description

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CNA: CISA-ADPCVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5638	CISA-ADP	US Government Resource
http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html	CVE	ExploitThird Party Advisory
http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/	CVE	ExploitThird Party Advisory
https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/	CVE	ExploitPress/Media Coverage
https://cwiki.apache.org/confluence/display/WW/S2-045	CVE	MitigationVendor Advisory
https://cwiki.apache.org/confluence/display/WW/S2-046	CVE	MitigationVendor Advisory
https://exploit-db.com/exploits/41570	CVE	ExploitThird Party AdvisoryVDB Entry
https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519a	CVE	Broken Link
https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228	CVE	Broken Link
https://github.com/mazen160/struts-pwn	CVE	Exploit
https://github.com/rapid7/metasploit-framework/issues/8064	CVE	ExploitIssue Tracking
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03733en_us	CVE	Broken Link
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03749en_us	CVE	Third Party Advisory
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_us	CVE	Third Party Advisory
https://isc.sans.edu/diary/22169	CVE	ExploitThird Party Advisory
https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E	CVE	Mailing List
https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E	CVE	Mailing List
https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E	CVE	Mailing List
https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html	CVE	ExploitThird Party Advisory
https://packetstormsecurity.com/files/141494/S2-45-poc.py.txt	CVE	Broken LinkExploitThird Party AdvisoryVDB Entry
https://security.netapp.com/advisory/ntap-20170310-0001/	CVE	Third Party Advisory
https://struts.apache.org/docs/s2-045.html	CVE	MitigationVendor Advisory
https://struts.apache.org/docs/s2-046.html	CVE	MitigationVendor Advisory
https://support.lenovo.com/us/en/product_security/len-14200	CVE	Third Party Advisory
https://twitter.com/theog150/status/841146956135124993	CVE	Broken LinkThird Party Advisory
https://www.exploit-db.com/exploits/41614/	CVE	ExploitThird Party AdvisoryVDB Entry
https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/	CVE	Third Party Advisory
https://www.kb.cert.org/vuls/id/834067	CVE	Third Party AdvisoryUS Government Resource
https://www.symantec.com/security-center/network-protection-security-advisories/SA145	CVE	Broken Link
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt	CVE	Third Party Advisory
http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html	CVE	Press/Media CoverageThird Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html	CVE	PatchThird Party Advisory
http://www.securityfocus.com/bid/96729	CVE	Broken LinkThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1037973	CVE	Broken LinkThird Party AdvisoryVDB Entry
http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html	[email protected]	ExploitThird Party Advisory
http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/	[email protected]	ExploitThird Party Advisory
https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/	[email protected]	ExploitPress/Media Coverage
https://cwiki.apache.org/confluence/display/WW/S2-045	[email protected]	MitigationVendor Advisory
https://cwiki.apache.org/confluence/display/WW/S2-046	[email protected]	MitigationVendor Advisory
https://exploit-db.com/exploits/41570	[email protected]	ExploitThird Party AdvisoryVDB Entry
https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519a	[email protected]	Broken Link
https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228	[email protected]	Broken Link
https://github.com/mazen160/struts-pwn	[email protected]	Exploit
https://github.com/rapid7/metasploit-framework/issues/8064	[email protected]	ExploitIssue Tracking
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03733en_us	[email protected]	Broken Link
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03749en_us	[email protected]	Third Party Advisory
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_us	[email protected]	Third Party Advisory
https://isc.sans.edu/diary/22169	[email protected]	ExploitThird Party Advisory
https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E	[email protected]	Mailing List
https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E	[email protected]	Mailing List
https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E	[email protected]	Mailing List
https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html	[email protected]	ExploitThird Party Advisory
https://packetstormsecurity.com/files/141494/S2-45-poc.py.txt	[email protected]	Broken LinkExploitThird Party AdvisoryVDB Entry
https://security.netapp.com/advisory/ntap-20170310-0001/	[email protected]	Third Party Advisory
https://struts.apache.org/docs/s2-045.html	[email protected]	MitigationVendor Advisory
https://struts.apache.org/docs/s2-046.html	[email protected]	MitigationVendor Advisory
https://support.lenovo.com/us/en/product_security/len-14200	[email protected]	Third Party Advisory
https://twitter.com/theog150/status/841146956135124993	[email protected]	Broken LinkThird Party Advisory
https://www.exploit-db.com/exploits/41614/	[email protected]	ExploitThird Party AdvisoryVDB Entry
https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/	[email protected]	Third Party Advisory
https://www.kb.cert.org/vuls/id/834067	[email protected]	Third Party AdvisoryUS Government Resource
https://www.symantec.com/security-center/network-protection-security-advisories/SA145	[email protected]	Broken Link
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt	[email protected]	Third Party Advisory
http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html	[email protected]	Press/Media CoverageThird Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html	[email protected]	PatchThird Party Advisory
http://www.securityfocus.com/bid/96729	[email protected]	Broken LinkThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1037973	[email protected]	Broken LinkThird Party AdvisoryVDB Entry

see all 67 references

This CVE is in CISA's Known Exploited Vulnerabilities Catalog

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Vulnerability Name	Date Added	Due Date	Required Action
Apache Struts Remote Code Execution Vulnerability	Nov 3, 2021	May 3, 2022	Apply updates per vendor instructions.

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-755	Improper Handling of Exceptional Conditions	[email protected]
CWE-755	Improper Handling of Exceptional Conditions	CISA-ADP

Affected Products

Product	Versions
apache struts	>= 2.2.3, < 2.3.32 >= 2.5.0, < 2.5.10.1
CPE cpe:2.3:a:apache:struts:::::::: Remediation No remediation found in references.
ibm storwize v3500 firmware	7.7.1.6 7.8.1.0
CPE cpe:2.3:o:ibm:storwize_v3500_firmware:7.7.1.6:::::::* cpe:2.3:o:ibm:storwize_v3500_firmware:7.8.1.0:::::::* Remediation No remediation found in references.
ibm storwize v3500	All versions
CPE cpe:2.3:h:ibm:storwize_v3500:-:::::::* Remediation No remediation found in references.
ibm storwize v5000 firmware	7.7.1.6 7.8.1.0
CPE cpe:2.3:o:ibm:storwize_v5000_firmware:7.7.1.6:::::::* cpe:2.3:o:ibm:storwize_v5000_firmware:7.8.1.0:::::::* Remediation No remediation found in references.
ibm storwize v5000	All versions
CPE cpe:2.3:h:ibm:storwize_v5000:-:::::::* Remediation No remediation found in references.
ibm storwize v7000 firmware	7.7.1.6 7.8.1.0
CPE cpe:2.3:o:ibm:storwize_v7000_firmware:7.7.1.6:::::::* cpe:2.3:o:ibm:storwize_v7000_firmware:7.8.1.0:::::::* Remediation No remediation found in references.
ibm storwize v7000	All versions
CPE cpe:2.3:h:ibm:storwize_v7000:-:::::::* Remediation No remediation found in references.
lenovo storage v5030 firmware	7.7.1.6 7.8.1.0
CPE cpe:2.3:o:lenovo:storage_v5030_firmware:7.7.1.6:::::::* cpe:2.3:o:lenovo:storage_v5030_firmware:7.8.1.0:::::::* Remediation No remediation found in references.
lenovo storage v5030	All versions
CPE cpe:2.3:h:lenovo:storage_v5030:-:::::::* Remediation No remediation found in references.
hp server automation	9.1.0 10.0.0 10.1.0 10.2.0 10.5.0
CPE cpe:2.3:a:hp:server_automation:9.1.0:::::::* cpe:2.3:a:hp:server_automation:10.0.0:::::::* cpe:2.3:a:hp:server_automation:10.1.0:::::::* cpe:2.3:a:hp:server_automation:10.2.0:::::::* cpe:2.3:a:hp:server_automation:10.5.0:::::::* Remediation No remediation found in references.
oracle weblogic server	10.3.6.0.0 12.1.3.0.0 12.2.1.1.0 12.2.1.2.0
CPE cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:::::::* cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:::::::* cpe:2.3:a:oracle:weblogic_server:12.2.1.1.0:::::::* cpe:2.3:a:oracle:weblogic_server:12.2.1.2.0:::::::* Remediation No remediation found in references.
arubanetworks clearpass policy manager	< 6.6.5
CPE cpe:2.3:a:arubanetworks:clearpass_policy_manager:::::::: Remediation No remediation found in references.
netapp oncommand balance	All versions
CPE cpe:2.3:a:netapp:oncommand_balance:-:::::::* Remediation No remediation found in references.

Change History

33 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	CISA-ADP
Jun 17, 2026	CVE Modified	[email protected]
Apr 21, 2026	Modified Analysis	[email protected]
Oct 22, 2025	CVE Modified	CISA-ADP
Oct 21, 2025	CVE Modified	CISA-ADP
Oct 21, 2025	CVE Modified	CISA-ADP
Mar 21, 2025	Modified Analysis	[email protected]
Feb 6, 2025	CVE Modified	CISA-ADP
Jan 23, 2025	Modified Analysis	[email protected]
Nov 21, 2024	CVE Modified	CVE
Jul 25, 2024	Modified Analysis	[email protected]
May 14, 2024	CVE Modified	[email protected]
Nov 7, 2023	CVE Modified	[email protected]
Feb 24, 2021	CVE Modified	[email protected]
Jan 26, 2021	CVE Modified	[email protected]
Jan 31, 2020	CVE Modified	[email protected]
Mar 4, 2018	CVE Modified	[email protected]
Nov 10, 2017	CVE Modified	[email protected]
Oct 10, 2017	CVE Modified	[email protected]
Sep 23, 2017	CVE Modified	[email protected]
Sep 22, 2017	CVE Modified	[email protected]
Aug 16, 2017	CVE Modified	[email protected]
Aug 9, 2017	CVE Modified	[email protected]
Jul 17, 2017	CVE Modified	[email protected]
May 27, 2017	CVE Modified	[email protected]
May 10, 2017	CVE Modified	[email protected]
Mar 30, 2017	CVE Modified	[email protected]
Mar 27, 2017	Reanalysis	[email protected]
Mar 15, 2017	Reanalysis	[email protected]
Mar 14, 2017	Reanalysis	[email protected]
Mar 14, 2017	Initial Analysis	[email protected]
Mar 14, 2017	CVE Modified	[email protected]
Mar 13, 2017	CVE Modified	[email protected]

CVE-2017-5638 Details

Description

Metrics

References to Advisories, Solutions, and Tools

This CVE is in CISA's Known Exploited Vulnerabilities Catalog

Weakness Enumeration

Affected Products

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

Change History

QUICK INFO