CVE-2017-9793

CVE-2017-9793: vulnerability in Apache Struts

Published 20 Sep 2017 · Updated 16 Sep 2024

Follow this CVE + Monitor Apache Struts + Monitor org.apache.struts:struts2-rest-plugin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 8.8%

The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.

Affected products

Apache Software Foundation · Apache Struts

Related CVEs — Apache Struts

In the same product, most dangerous first.

CVE-2017-5638CRITICALCVE-2017-5638EPSS 100.0%KEV CVE-2018-11776HIGHCVE-2018-11776EPSS 100.0%KEV CVE-2017-9805HIGHCVE-2017-9805EPSS 99.4%KEV CVE-2017-9791CRITICALCVE-2017-9791EPSS 98.9%KEV CVE-2020-17530CRITICALCVE-2020-17530EPSS 96.3%KEV CVE-2017-12611—CVE-2017-12611EPSS 87.1%

References

https://security.netapp.com/advisory/ntap-20180629-0001/https://struts.apache.org/docs/s2-051.html https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2 http://www.brocade.com/content/dam/common/documents/content-types/security-bulletin/brocade-security-advisory-2017-429.htm http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html http://www.securityfocus.com/bid/100611 http://www.securitytracker.com/id/1039262