GitHub Advisoryadvisory · Maven

GHSA-gg9m-fj3v-r58c REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering

HIGH Published 2018-10-16 Modified 2025-10-22 Official page ↗
Aliases
CVE-2017-9805
Ecosystem
Maven
Packages
org.apache.struts:struts2-rest-plugin
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weaknesses
CWE-502
Reviewed
2020-06-16

Affected packages

• Maven org.apache.struts:struts2-rest-plugin: >= 2.1.1, < 2.3.34 → fixed in 2.3.34 • Maven org.apache.struts:struts2-rest-plugin: >= 2.5.0, < 2.5.13 → fixed in 2.5.13

Description

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

Related

Alias · CVE (1)

  • CVE-2017-9805 The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References