CVE-2017-9787

CVE-2017-9787: vulnerability in Apache Struts

Published 13 Jul 2017 · Updated 17 Sep 2024

Follow this CVE + Monitor Apache Struts + Monitor org.apache.struts:struts2-core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 11%

When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33.

Affected products

Apache Software Foundation · Apache Struts

Related CVEs — Apache Struts

In the same product, most dangerous first.

CVE-2017-5638CRITICALCVE-2017-5638EPSS 100.0%KEV CVE-2018-11776HIGHCVE-2018-11776EPSS 100.0%KEV CVE-2017-9805HIGHCVE-2017-9805EPSS 99.4%KEV CVE-2017-9791CRITICALCVE-2017-9791EPSS 98.9%KEV CVE-2020-17530CRITICALCVE-2020-17530EPSS 96.3%KEV CVE-2017-12611—CVE-2017-12611EPSS 87.1%

References

https://lists.apache.org/thread.html/3795c4dd46d9ec75f4a6eb9eca11c11edd3e796c6c1fd7b17b5dc50d%40%3Cannouncements.struts.apache.org%3E https://lists.apache.org/thread.html/de3d325f0433cd3b42258b6a302c0d7a72b69eedc1480ed561d3b065%40%3Cannouncements.struts.apache.org%3E https://security.netapp.com/advisory/ntap-20180706-0002/http://struts.apache.org/docs/s2-049.html http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html http://www.securityfocus.com/bid/99562 http://www.securitytracker.com/id/1039115