cvelist/2017/12xxx/CVE-2017-12611.json
2019-03-17 22:55:34 +00:00

86 lines
3.1 KiB
JSON

{
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"DATE_PUBLIC": "2017-09-07T00:00:00",
"ID": "CVE-2017-12611",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Apache Struts",
"version": {
"version_data": [
{
"version_value": "2.0.1 - 2.3.33"
},
{
"version_value": "2.5 - 2.5.10"
}
]
}
}
]
},
"vendor_name": "Apache Software Foundation"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Apache Struts 2.0.1 through 2.3.33 and 2.5 through 2.5.10, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "A possible Remote Code Execution attack when using an unintentional expression in Freemarker tag instead of string literals"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html"
},
{
"name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt",
"refsource": "CONFIRM",
"url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt"
},
{
"name": "https://struts.apache.org/docs/s2-053.html",
"refsource": "CONFIRM",
"url": "https://struts.apache.org/docs/s2-053.html"
},
{
"name": "100829",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/100829"
},
{
"name": "https://kb.netapp.com/support/s/article/ka51A000000CgttQAC/NTAP-20170911-0001",
"refsource": "CONFIRM",
"url": "https://kb.netapp.com/support/s/article/ka51A000000CgttQAC/NTAP-20170911-0001"
}
]
}
}