CVE-2017-9805

En bref

Sévérité: HIGH 8.1
Exploitation: Exploitation connue (CISA KEV) · ajoutée le 2021-11-03
Exploitée selon l'ENISA depuis le 2021-11-03
EPSS: EPSS 99.40 % · centile 100 (2026-10-27)
État: PUBLISHED
Publiée: 2017-09-15
Mise à jour: 2025-10-21
Attribuée par: apache
Statut NVD: Analyzed

Description

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP
CVSS 3.1	HIGH 8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 3.1	HIGH 8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
CVSS 2.0	MEDIUM 6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P	NVD · nvd@nist.gov (Primary)

Faiblesses (CWE)

CWE-502

Avis

GHSA-gg9m-fj3v-r58c — REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering

Références européennes

ENISA EUVD · EUVD-2018-0602
GCVE · GCVE-0-2017-9805

Avis du CERT-FR

CERTFR-2017-AVI-285 — Vulnérabilité dans Apache Struts · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* ≥ 2.1.2 < 2.3.34
cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* ≥ 2.5.0 < 2.5.13
cpe:2.3:a:cisco:digital_media_manager:-:*:*:*:*:*:*:*
cpe:2.3:a:cisco:hosted_collaboration_solution:10.5\(1\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:hosted_collaboration_solution:11.0\(1\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:hosted_collaboration_solution:11.5\(1\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:hosted_collaboration_solution:11.6\(1\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:media_experience_engine:3.5:*:*:*:*:*:*:*
cpe:2.3:a:cisco:media_experience_engine:3.5.2:*:*:*:*:*:*:*
cpe:2.3:a:cisco:network_performance_analysis:-:*:*:*:*:*:*:*
cpe:2.3:a:cisco:video_distribution_suite_for_internet_streaming:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
Apache Software Foundation · Apache Struts	affected Apache Struts before 2.3.34 and 2.5.x before 2.5.13

Références

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
CISA Known Exploited Vulnerabilities	CC0 1.0
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD