CVE-2017-9791
En bref Sévérité CRITICAL 9.8 Exploitation Exploitation connue (CISA KEV) · ajoutée le 2022-02-10 Exploitée selon l'ENISA depuis le 2022-02-10 EPSS EPSS 98.91 % · centile 100 (2026-10-27) État PUBLISHED Publiée 2017-07-10 Mise à jour 2025-10-21 Attribuée par apache Statut NVD Analyzed Description The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
Scores Version Score Vecteur Évalué par CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary) CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) CVSS 2.0 HIGH 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Avis
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.20.3:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.31:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.32:*:*:*:*:*:*:*Produits affectés
Références
Sources
