Description
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
Metrics
CVSS 3.1 8.1/10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Struts | Apache Struts before 2.3.34 and 2.5.x before 2.5.13 |
References
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.htmlPatch, Third Party Advisory
- http://www.securityfocus.com/bid/100609Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039263Broken Link, Third Party Advisory, VDB Entry
- https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifaxVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1488482Issue Tracking, Third Party Advisory, VDB Entry
- https://cwiki.apache.org/confluence/display/WW/S2-052Mitigation, Vendor Advisory
- https://lgtm.com/blog/apache_struts_CVE-2017-9805Broken Link
- https://security.netapp.com/advisory/ntap-20170907-0001/Third Party Advisory
- https://struts.apache.org/docs/s2-052.htmlMitigation, Vendor Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2Third Party Advisory
- https://www.exploit-db.com/exploits/42627/Exploit, Third Party Advisory, VDB Entry
- https://www.kb.cert.org/vuls/id/112992Third Party Advisory, US Government Resource
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.htmlPatch, Third Party Advisory
- http://www.securityfocus.com/bid/100609Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039263Broken Link, Third Party Advisory, VDB Entry
- https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifaxVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1488482Issue Tracking, Third Party Advisory, VDB Entry
- https://cwiki.apache.org/confluence/display/WW/S2-052Mitigation, Vendor Advisory
- https://lgtm.com/blog/apache_struts_CVE-2017-9805Broken Link
- https://security.netapp.com/advisory/ntap-20170907-0001/Third Party Advisory
- https://struts.apache.org/docs/s2-052.htmlMitigation, Vendor Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2Third Party Advisory
- https://www.exploit-db.com/exploits/42627/Exploit, Third Party Advisory, VDB Entry
- https://www.kb.cert.org/vuls/id/112992Third Party Advisory, US Government Resource
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9805US Government Resource
Timeline
- Published
- Sep 15, 2017
- Last modified
- Jun 17, 2026
- Added to CISA KEV
- Nov 3, 2021
- NVD status
- Analyzed