Question

A vulnerability scanner reports that a critical Apache Struts remote code execution flaw (CVE-2017-5638) is present on a production web server. Before the analyst escalates the finding to the patching team, the server owner insists the application was migrated to a Java Spring framework months ago and no longer uses Struts. Which action should the analyst take FIRST to determine whether this is a false positive?

Accepted Answer

Manually verify by inspecting the server's installed libraries and application files, and attempt to confirm the vulnerable component and version actually exist

Answer

Immediately close the finding as a false positive because the application owner confirmed Struts is no longer in use

Answer

Escalate the critical finding to the patching team without further review to meet the remediation SLA

Answer

Re-run the scan with a different vulnerability scanner and accept whatever the second tool reports