CVEvulnerability

CVE-2017-9793

7.5 HIGH Published 2017-09-20 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-09-20
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
CWE-20

Description

The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.

Affected configurations

• apache struts 2.3.7 • apache struts 2.3.8 • apache struts 2.3.9 • apache struts 2.3.10 • apache struts 2.3.11 • apache struts 2.3.12 • apache struts 2.3.13 • apache struts 2.3.14 • apache struts 2.3.14.1 • apache struts 2.3.14.2 • apache struts 2.3.14.3 • apache struts 2.3.15 • apache struts 2.3.15.1 • apache struts 2.3.15.2 • apache struts 2.3.15.3 • apache struts 2.3.16 • apache struts 2.3.16.1 • apache struts 2.3.16.2 • apache struts 2.3.16.3 • apache struts 2.3.17 • apache struts 2.3.19 • apache struts 2.3.20 • apache struts 2.3.20.1 • apache struts 2.3.20.2 • apache struts 2.3.21 • apache struts 2.3.22 • apache struts 2.3.23 • apache struts 2.3.24.2 • apache struts 2.3.24.3 • apache struts 2.3.25 • apache struts 2.3.26 • apache struts 2.3.27 • apache struts 2.3.28 • apache struts 2.3.28.1 • apache struts 2.3.29 • apache struts 2.3.30 • apache struts 2.3.31 • apache struts 2.3.32 • apache struts 2.3.33 • apache struts 2.5 • apache struts 2.5.1 • apache struts 2.5.2 • apache struts 2.5.3 • apache struts 2.5.4 • apache struts 2.5.5 • apache struts 2.5.6 • apache struts 2.5.7 • apache struts 2.5.8 • apache struts 2.5.9 • apache struts 2.5.10 • apache struts 2.5.10.1 • apache struts 2.5.12

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References