Is the CA Advanced Auth impacted by vulnerability CVE-2018-11776

Products

• CA Rapid App Security
• CA Advanced Authentication

Issue/Introduction

Is CA Advanced Authentication impacted by vulnerability CVE-2018-11776?

NIST:

https://nvd.nist.gov/vuln/detail/CVE-2018-11776

The MITRE CVE dictionary describes this issue as:

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when using results with no namespace and in same time, its upper action(s) have no or wildcard namespace. Same possibility when using url tag which doesn't have value and action set and in same time, its upper action(s) have no or wildcard namespace.
Find out more about CVE-2018-11776 from the MITRE CVE dictionary and NIST NVD.
 

Environment

Release:
Component: RSKFRT

Resolution

The CA team has confirmed that all versions of CA Advanced Auth are not vulnerable to this exploit.

CA Advanced Auth Versions 8.X and 9.x use Apache Struts version 1 which is not susceptible to this vulnerability.

With the next release of CA Advanced Auth, we will be updating Apache Struts to a version where this vulnerability is addressed.