peter bassill · operator
$ cve CVE-2017-9805 JSON

CVE-2017-9805 KEV EXPLOIT

8.1
HIGH · CVSS 3.1 · EPSS 99.4% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-05-03.

Description

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

Scoring

CVSS8.1 (HIGH, v3.1)
VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS99.4% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-502
On CISA KEVyes — remediate by 2022-05-03
Public exploityes
Published2017-09-15
Last modified2026-06-17

CISA KEV

NameApache Struts Deserialization of Untrusted Data Vulnerability
Added2021-11-03
Due2022-05-03
Vendor / productApache / Struts
Ransomware usenone reported

Affected (7)

VendorProduct
apachestruts
ciscodigital media manager
ciscohosted collaboration solution
ciscomedia experience engine
cisconetwork performance analysis
ciscovideo distribution suite for internet streaming
netapponcommand balance

Public exploits

SourceTitleDate
exploit-dbApache Struts 2.5 < 2.5.12 - REST Plugin XStream Remote Code Execution2017-09-06

References

→ the Explorer  ·  watch your stack  ·  NVD