CVE-2017-12611: Apache Struts 2.0.1 RCE Vulnerability
Summary
CVE-2017-12611: Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literal. Affects org.apache.struts:struts2-core across 2 version ranges.
>= 2.0.1, < 2.3.34
>= 2.5.0, < 2.5.11
Fixed in 2.3.34 or 2.5.11, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Struts is an open-source framework used for developing Java web applications. It provides a set of tools and libraries to simplify the development process. The struts2-core package is a core component of Apache Struts, responsible for handling the framework's core functionalities. This package is vulnerable to a remote code execution (RCE) attack.
Vulnerability Detail
The vulnerability (CVE-2017-12611) exists in Apache Struts 2.0.1 through 2.3.33 and 2.5 through 2.5.10. It occurs when an unintentional expression is used in a Freemarker tag instead of string literals. This flaw can be exploited by an attacker to execute arbitrary code on the target system, potentially leading to a complete compromise of the application and the underlying server. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 9.8, indicating its critical severity.
How To Fix
Latest published version: 7.4.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.0.1, < 2.3.342.3.34 -
>= 2.5.0, < 2.5.112.5.11
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a temporary workaround can be implemented. This involves modifying the affected Freemarker tags to ensure that only string literals are used, instead of unintentional expressions. Here is an example of the modified code:
<#assign cmd = 'command_to_execute'>
<@s.set var='cmd' value='command_to_execute' />
By explicitly assigning the value as a string literal, the vulnerability can be mitigated.
Conclusion
The Apache Struts 2.0.1 RCE vulnerability (CVE-2017-12611) poses a critical risk to applications using the affected versions of the struts2-core package. It is crucial to promptly upgrade to the recommended fixed versions or apply the provided workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.struts:struts2-core →
FAQ
Apache Struts is an open-source framework for developing Java web applications. It provides a set of tools and libraries to simplify the development process.
The struts2-core package is a core component of Apache Struts responsible for handling the framework's core functionalities.
A remote code execution vulnerability allows an attacker to execute arbitrary code on a target system, potentially leading to a complete compromise of the application and the underlying server.
The CVSS score for this vulnerability is 9.8, indicating its critical severity.
To fix this vulnerability, upgrade the Apache Struts struts2-core package to the recommended fixed versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts2-core.
