CVE-2017-9791: critical vulnerability in Apache Struts
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
Apache Struts 2 allows attackers to execute arbitrary code on the server by sending specially crafted field values through the Struts 1 plugin. This is a critical vulnerability that can give attackers complete control over the affected web application.
A improper input validation flaw in the Struts 1 plugin (CWE-20) enables remote code execution when malicious field values are passed in raw messages to the ActionMessage handler. The attack requires network access to the affected Struts application but no authentication, with impact including complete system compromise.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.