High severity · published Sep 15, 2017
CVE-2017-9805
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type…
In wildKEV
8.1
CVSS
99.4%
EPSS
Yes
On KEV
Description
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)99.4% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 3, 2021
Federal remediation dueMay 3, 2022
Ransomware campaign useNot known
Affected products
Which versions
ST
Struts · Apache
Apache Struts before 2.3.34 and 2.5.x before 2.5.13 · source: vendor, NVD, KEV
DM
Digital Media Manager · Cisco
All versions, or not specified · source: NVD
HC
Hosted Collaboration Solution · Cisco
10.5(1); 11.0(1); 11.5(1); 11.6(1) · source: NVD
ME
Media Experience Engine · Cisco
3.5; 3.5.2 · source: NVD
NP
Network Performance Analysis · Cisco
All versions, or not specified · source: NVD
OB
Oncommand Balance · Netapp
All versions, or not specified · source: NVD
VD
Video Distribution Suite For Internet Streaming · Cisco
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-9805
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-9805
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Patch
http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
Broken Link
http://www.securityfocus.com/bid/100609
Broken Link
http://www.securitytracker.com/id/1039263
Vendor Advisory
https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1488482
Mitigation
https://cwiki.apache.org/confluence/display/WW/S2-052
More from Struts
9.8
CVE-2020-17530
Apache Struts Remote Code Execution Vulnerability
9.8
CVE-2017-9791
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage
9.8
CVE-2017-5638
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload…
9.8
CVE-2013-2251
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction:…
9.8
CVE-2012-0391
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of…