CVEvulnerability
CVE-2017-9805
CISA Known Exploited Vulnerability
Apache Struts Deserialization of Untrusted Data Vulnerability — Apache Struts
Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.
- Added to KEV
- 2021-11-03
- Remediation due
- 2022-05-03
- Ransomware use
- Unknown
- Required action
- Apply updates per vendor instructions.
- Notes
- https://nvd.nist.gov/vuln/detail/CVE-2017-9805
- Status
- Analyzed
- Published
- 2017-09-15
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-502
Description
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
Affected configurations
• apache struts (>= 2.1.2 < 2.3.34)
• apache struts (>= 2.5.0 < 2.5.13)
• cisco digital media manager
• cisco hosted collaboration solution 10.5\(1\)
• cisco hosted collaboration solution 11.0\(1\)
• cisco hosted collaboration solution 11.5\(1\)
• cisco hosted collaboration solution 11.6\(1\)
• cisco media experience engine 3.5
• cisco media experience engine 3.5.2
• cisco network performance analysis
• cisco video distribution suite for internet streaming
• netapp oncommand balance
Related
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html Patch, Third Party Advisory
- http://www.securityfocus.com/bid/100609 Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039263 Broken Link, Third Party Advisory, VDB Entry
- https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1488482 Issue Tracking, Third Party Advisory, VDB Entry
- https://cwiki.apache.org/confluence/display/WW/S2-052 Mitigation, Vendor Advisory
- https://lgtm.com/blog/apache_struts_CVE-2017-9805 Broken Link
- https://security.netapp.com/advisory/ntap-20170907-0001/ Third Party Advisory
- https://struts.apache.org/docs/s2-052.html Mitigation, Vendor Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2 Third Party Advisory
- https://www.exploit-db.com/exploits/42627/ Exploit, Third Party Advisory, VDB Entry
- https://www.kb.cert.org/vuls/id/112992 Third Party Advisory, US Government Resource
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html Patch, Third Party Advisory
- http://www.securityfocus.com/bid/100609 Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039263 Broken Link, Third Party Advisory, VDB Entry
- https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1488482 Issue Tracking, Third Party Advisory, VDB Entry
- https://cwiki.apache.org/confluence/display/WW/S2-052 Mitigation, Vendor Advisory
- https://lgtm.com/blog/apache_struts_CVE-2017-9805 Broken Link
- https://security.netapp.com/advisory/ntap-20170907-0001/ Third Party Advisory
- https://struts.apache.org/docs/s2-052.html Mitigation, Vendor Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2 Third Party Advisory
- https://www.exploit-db.com/exploits/42627/ Exploit, Third Party Advisory, VDB Entry
- https://www.kb.cert.org/vuls/id/112992 Third Party Advisory, US Government Resource
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9805 US Government Resource