{"containers": {"cna": {"affected": [{"product": "Apache Struts", "vendor": "Apache Software Foundation", "versions": [{"status": "affected", "version": "Apache Struts before 2.3.34 and 2.5.x before 2.5.13"}]}], "datePublic": "2017-09-15T00:00:00", "descriptions": [{"lang": "en", "value": "The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads."}], "problemTypes": [{"descriptions": [{"description": "RCE", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-08-12T20:45:53", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://struts.apache.org/docs/s2-052.html"}, {"name": "1039263", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1039263"}, {"name": "100609", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/100609"}, {"name": "20170907 Multiple Vulnerabilities in Apache Struts 2 Affecting Cisco Products: September 2017", "tags": ["vendor-advisory", "x_refsource_CISCO"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1488482"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax"}, {"name": "42627", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/42627/"}, {"tags": ["x_refsource_MISC"], "url": "https://lgtm.com/blog/apache_struts_CVE-2017-9805"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://cwiki.apache.org/confluence/display/WW/S2-052"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://security.netapp.com/advisory/ntap-20170907-0001/"}, {"name": "VU#112992", "tags": ["third-party-advisory", "x_refsource_CERT-VN"], "url": "https://www.kb.cert.org/vuls/id/112992"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@apache.org", "ID": "CVE-2017-9805", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Apache Struts", "version": {"version_data": [{"version_value": "Apache Struts before 2.3.34 and 2.5.x before 2.5.13"}]}}]}, "vendor_name": "Apache Software Foundation"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "RCE"}]}]}, "references": {"reference_data": [{"name": "http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html"}, {"name": "https://struts.apache.org/docs/s2-052.html", "refsource": "CONFIRM", "url": "https://struts.apache.org/docs/s2-052.html"}, {"name": "1039263", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1039263"}, {"name": "100609", "refsource": "BID", "url": "http://www.securityfocus.com/bid/100609"}, {"name": "20170907 Multiple Vulnerabilities in Apache Struts 2 Affecting Cisco Products: September 2017", "refsource": "CISCO", "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2"}, {"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1488482", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1488482"}, {"name": "https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax", "refsource": "CONFIRM", "url": "https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax"}, {"name": "42627", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/42627/"}, {"name": "https://lgtm.com/blog/apache_struts_CVE-2017-9805", "refsource": "MISC", "url": "https://lgtm.com/blog/apache_struts_CVE-2017-9805"}, {"name": "https://cwiki.apache.org/confluence/display/WW/S2-052", "refsource": "CONFIRM", "url": "https://cwiki.apache.org/confluence/display/WW/S2-052"}, {"name": "https://security.netapp.com/advisory/ntap-20170907-0001/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20170907-0001/"}, {"name": "VU#112992", "refsource": "CERT-VN", "url": "https://www.kb.cert.org/vuls/id/112992"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T17:18:01.942Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://struts.apache.org/docs/s2-052.html"}, {"name": "1039263", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1039263"}, {"name": "100609", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/100609"}, {"name": "20170907 Multiple Vulnerabilities in Apache Struts 2 Affecting Cisco Products: September 2017", "tags": ["vendor-advisory", "x_refsource_CISCO", "x_transferred"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1488482"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax"}, {"name": "42627", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/42627/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://lgtm.com/blog/apache_struts_CVE-2017-9805"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://cwiki.apache.org/confluence/display/WW/S2-052"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://security.netapp.com/advisory/ntap-20170907-0001/"}, {"name": "VU#112992", "tags": ["third-party-advisory", "x_refsource_CERT-VN", "x_transferred"], "url": "https://www.kb.cert.org/vuls/id/112992"}]}]}, "cveMetadata": {"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2017-9805", "datePublished": "2017-09-15T19:00:00", "dateReserved": "2017-06-21T00:00:00", "dateUpdated": "2024-08-05T17:18:01.942Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"cisaActionDue": "2022-05-03", "cisaExploitAdd": "2021-11-03", "cisaRequiredAction": "Apply updates per vendor instructions.", "cisaVulnerabilityName": "Apache Struts Deserialization of Untrusted Data Vulnerability", "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*", "matchCriteriaId": "13744BE3-2443-4640-BDB4-722C4D393B65", "versionEndExcluding": "2.3.34", "versionStartIncluding": "2.1.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B45E858-E783-4D6E-AFD3-97E9963EB05B", "versionEndExcluding": "2.5.13", "versionStartIncluding": "2.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:digital_media_manager:-:*:*:*:*:*:*:*", "matchCriteriaId": "E0B1E953-33EF-498D-AB75-4A0A7733BC54", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:hosted_collaboration_solution:10.5\\(1\\):*:*:*:*:*:*:*", "matchCriteriaId": "CF4C9089-0F27-4C66-8E12-2BCAC148B7C9", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:hosted_collaboration_solution:11.0\\(1\\):*:*:*:*:*:*:*", "matchCriteriaId": "7FCC3E9D-4D39-4530-A5FC-7E9A4E395D60", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:hosted_collaboration_solution:11.5\\(1\\):*:*:*:*:*:*:*", "matchCriteriaId": "F972A2A1-3002-4086-8FA2-F231D4ED0B00", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:hosted_collaboration_solution:11.6\\(1\\):*:*:*:*:*:*:*", "matchCriteriaId": "D52C5D91-33D1-4C90-BEC9-90D955AA5883", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:media_experience_engine:3.5:*:*:*:*:*:*:*", "matchCriteriaId": "93C3A3B2-B346-47F4-B987-0098AB95F939", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:media_experience_engine:3.5.2:*:*:*:*:*:*:*", "matchCriteriaId": "87CCEC7F-058D-4202-88B3-F06372DFFA99", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:network_performance_analysis:-:*:*:*:*:*:*:*", "matchCriteriaId": "76D400A4-9918-494E-89B7-EAA57B2830D2", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:video_distribution_suite_for_internet_streaming:-:*:*:*:*:*:*:*", "matchCriteriaId": "912F9C5E-AA5F-4746-AC49-D33C2495C73B", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*", "matchCriteriaId": "7DCBCC5D-C396-47A8-ADF4-D3A2C4377FB1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads."}, {"lang": "es", "value": "El Plugin REST en Apache Struts versiones 2.1.1 hasta 2.3.x anteriores a 2.3.34 y versiones 2.5.x anteriores a 2.5.13, usa una XStreamHandler con una instancia de XStream para deserializaci\u00f3n sin ning\u00fan filtrado de tipos, lo que puede conllevar a una ejecuci\u00f3n de c\u00f3digo remota cuando se deserializan cargas XML."}], "id": "CVE-2017-9805", "lastModified": "2024-07-25T13:40:54.857", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-09-15T19:29:00.237", "references": [{"source": "security@apache.org", "tags": ["Patch", "Third Party Advisory"], "url": "http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html"}, {"source": "security@apache.org", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/100609"}, {"source": "security@apache.org", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1039263"}, {"source": "security@apache.org", "tags": ["Vendor Advisory"], "url": "https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax"}, {"source": "security@apache.org", "tags": ["Issue Tracking", "Third Party Advisory", "VDB Entry"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1488482"}, {"source": "security@apache.org", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://cwiki.apache.org/confluence/display/WW/S2-052"}, {"source": "security@apache.org", "tags": ["Broken Link"], "url": "https://lgtm.com/blog/apache_struts_CVE-2017-9805"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20170907-0001/"}, {"source": "security@apache.org", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://struts.apache.org/docs/s2-052.html"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2"}, {"source": "security@apache.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "https://www.exploit-db.com/exploits/42627/"}, {"source": "security@apache.org", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.kb.cert.org/vuls/id/112992"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "struts: RCE attack via REST plugin with XStream handler to deserialise XML requests", "id": "1488482", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1488482"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-20", "details": ["The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.", "The REST Plugin in Apache Struts2 is using a XStreamHandler with an instance of XStream for deserialization without any type filtering which could lead to Remote Code Execution when deserializing XML payloads. An attacker could use this flaw to execute arbitrary code or conduct further attacks."], "name": "CVE-2017-9805", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "struts", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/a:redhat:jboss_data_virtualization:6", "fix_state": "Not affected", "package_name": "struts", "product_name": "Red Hat JBoss Data Virtualization 6"}, {"cpe": "cpe:/a:redhat:jboss_fuse_service_works:6", "fix_state": "Not affected", "package_name": "struts", "product_name": "Red Hat JBoss Fuse Service Works 6"}, {"cpe": "cpe:/a:redhat:jboss_operations_network:3", "fix_state": "Not affected", "package_name": "struts", "product_name": "Red Hat JBoss Operations Network 3"}, {"cpe": "cpe:/a:redhat:network_satellite:5", "fix_state": "Not affected", "package_name": "struts", "product_name": "Red Hat Satellite 5"}], "public_date": "2017-09-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2017-9805\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-9805\nhttps://struts.apache.org/docs/s2-052.html\nhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog"], "statement": "A previous statement by Red Hat related to this CVE, prior to August 2019, said that Apache Struts 2 is not included in any Red Hat products. This earlier statement was incorrect. While Struts 2 is not actively compiled, shipped, used, or enabled in any Red Hat provided final products, and does not cause any vulnerability in the product, struts2-core jars have been included in some products' source code packages. The inclusion was part of an import of the Google Guice repository, which includes struts2-core. Customers that build artefacts from our source code could be at risk. Red Hat will remove these artefacts from source code in future releases.\nThe products that included the Struts 2 artefacts in their source jars:\nFuse Service Works 6.0.0\nSingle Sign On 7.3.0+\nIf you have used the source package from one of these products to build artefacts on your system, you should do the following to remove potentially affected jars:\n1. Run 'find . -name struts2*.jar' under the source location\n2. Remove any files found\nThis will not affect the product, as the jar is included with the source of google-guice, but no functionality requiring struts2 is implemented.", "threat_severity": "Important", "upstream_fix": "struts 2.5.13"}