CVE-2017-9791

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Struts	2.1.x series; 2.3.x series

References

http://struts.apache.org/docs/s2-048.htmlMitigation, Vendor Advisory
http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.htmlPatch, Third Party Advisory
http://www.securityfocus.com/bid/99484Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038838Broken Link, Third Party Advisory, VDB Entry
https://security.netapp.com/advisory/ntap-20180706-0002/Third Party Advisory
https://www.exploit-db.com/exploits/42324/Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/44643/Third Party Advisory, VDB Entry
http://struts.apache.org/docs/s2-048.htmlMitigation, Vendor Advisory
http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.htmlPatch, Third Party Advisory
http://www.securityfocus.com/bid/99484Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038838Broken Link, Third Party Advisory, VDB Entry
https://security.netapp.com/advisory/ntap-20180706-0002/Third Party Advisory
https://www.exploit-db.com/exploits/42324/Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/44643/Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9791US Government Resource

Timeline

Published: Jul 10, 2017
Last modified: Jun 17, 2026
Added to CISA KEV: Feb 10, 2022
NVD status: Analyzed

Related CVEs from 2017

CVE-2017-97926.5In Apache Impala (incubating) before 2.10.0, a malicious user with "ALTER" permissions on an Impala table can access any other Kudu table da CVE-2017-97937.5The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable CVE-2017-97944.3When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to e CVE-2017-97957.5When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster m CVE-2017-97965.3When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster m CVE-2017-97976.5When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode a CVE-2017-97987.5Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, o CVE-2017-97998.8It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically poss CVE-2017-98009.8A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha CVE-2017-98017.5When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitra CVE-2017-98026.1The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input stri CVE-2017-98037.5Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-