CVE-2017-12611
Fixed upstream EPSS 87%
In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
Products: Apache Software Foundation Apache Struts
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.struts:struts2-core | 2.3.34 |
| Maven | org.apache.struts:struts2-core | 2.5.11 |