CVE-2017-9793

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Struts	2.3.7 - 2.3.33; 2.5 - 2.5.12; 2.1.x series

References

http://www.brocade.com/content/dam/common/documents/content-types/security-bulletin/brocade-security-advisory-2017-429.htmThird Party Advisory
http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.htmlPatch, Third Party Advisory
http://www.securityfocus.com/bid/100611Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039262Third Party Advisory, VDB Entry
https://security.netapp.com/advisory/ntap-20180629-0001/
https://struts.apache.org/docs/s2-051.htmlPatch, Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2Third Party Advisory
http://www.brocade.com/content/dam/common/documents/content-types/security-bulletin/brocade-security-advisory-2017-429.htmThird Party Advisory
http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.htmlPatch, Third Party Advisory
http://www.securityfocus.com/bid/100611Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039262Third Party Advisory, VDB Entry
https://security.netapp.com/advisory/ntap-20180629-0001/
https://struts.apache.org/docs/s2-051.htmlPatch, Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2Third Party Advisory

Timeline

Published: Sep 20, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-97944.3When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to e CVE-2017-97957.5When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster m CVE-2017-97965.3When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster m CVE-2017-97976.5When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode a CVE-2017-97987.5Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, o CVE-2017-97998.8It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically poss CVE-2017-98009.8A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha CVE-2017-98017.5When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitra CVE-2017-98026.1The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input stri CVE-2017-98037.5Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-CVE-2017-98047.5In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValida CVE-2017-98058.1The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStrea