ID:6290 - Exploit for Improper input validation in Apache Struts - CVE-2018-11776

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient input validation in cases where namespace value isn't set for a result defined in underlying xml configurations and in same time, its upper action(s) configurations have no or wildcard namespace, or when using url tag which doesn’t have value and action set and in same time, its upper action(s) configurations have no or wildcard namespace.

A remote unauthenticated attacker can compromise the affected system.

Remediation