CVEvulnerability
CVE-2017-9804
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-09-20
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
- Weaknesses
- CWE-20
Description
In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.
Affected configurations
• apache struts 2.3.7
• apache struts 2.3.8
• apache struts 2.3.9
• apache struts 2.3.10
• apache struts 2.3.11
• apache struts 2.3.12
• apache struts 2.3.13
• apache struts 2.3.14
• apache struts 2.3.14.1
• apache struts 2.3.14.2
• apache struts 2.3.14.3
• apache struts 2.3.15
• apache struts 2.3.15.1
• apache struts 2.3.15.2
• apache struts 2.3.15.3
• apache struts 2.3.16
• apache struts 2.3.16.1
• apache struts 2.3.16.2
• apache struts 2.3.16.3
• apache struts 2.3.17
• apache struts 2.3.19
• apache struts 2.3.20
• apache struts 2.3.20.1
• apache struts 2.3.20.2
• apache struts 2.3.21
• apache struts 2.3.22
• apache struts 2.3.23
• apache struts 2.3.24.2
• apache struts 2.3.24.3
• apache struts 2.3.25
• apache struts 2.3.26
• apache struts 2.3.27
• apache struts 2.3.28
• apache struts 2.3.28.1
• apache struts 2.3.29
• apache struts 2.3.30
• apache struts 2.3.31
• apache struts 2.3.32
• apache struts 2.3.33
• apache struts 2.5
• apache struts 2.5.1
• apache struts 2.5.2
• apache struts 2.5.3
• apache struts 2.5.4
• apache struts 2.5.5
• apache struts 2.5.6
• apache struts 2.5.7
• apache struts 2.5.8
• apache struts 2.5.9
• apache struts 2.5.10
• apache struts 2.5.10.1
• apache struts 2.5.12
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html Patch, Third Party Advisory
- http://www.securityfocus.com/bid/100612 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039261 Third Party Advisory, VDB Entry
- https://security.netapp.com/advisory/ntap-20180629-0001/ security.netapp.com
- https://struts.apache.org/docs/s2-050.html Patch, Vendor Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2 Third Party Advisory
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html Patch, Third Party Advisory
- http://www.securityfocus.com/bid/100612 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039261 Third Party Advisory, VDB Entry
- https://security.netapp.com/advisory/ntap-20180629-0001/ security.netapp.com
- https://struts.apache.org/docs/s2-050.html Patch, Vendor Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2 Third Party Advisory