CVE-2017-9805

Apache Struts Deserialization of Untrusted Data

8.1 HIGHActively exploited (CISA KEV)Public exploitEPSS 99.4%

Published15 Sept 2017
Added to CISA KEV3 Nov 2021
Remediation due3 May 2022

Description

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityHigh

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Apache Struts≥ 2.1.2 < 2.3.34 · ≥ 2.5.0 < 2.5.13

Cisco Digital Media Managerall versions

Cisco Hosted Collaboration Solution10.5\(1\) · 11.0\(1\) · 11.5\(1\) · 11.6\(1\)

Cisco Media Experience Engine3.5 · 3.5.2

Cisco Network Performance Analysisall versions

Cisco Video Distribution Suite For Internet Streamingall versions

Netapp Oncommand Balanceall versions

Remediation

Fixed in

Apache Struts≥ 2.3.34

Patch & vendor advisories

References

https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifaxVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1488482Issue TrackingThird Party AdvisoryVDB Entry
https://cwiki.apache.org/confluence/display/WW/S2-052MitigationVendor Advisory
https://lgtm.com/blog/apache_struts_CVE-2017-9805Broken Link
https://security.netapp.com/advisory/ntap-20170907-0001/Third Party Advisory
https://struts.apache.org/docs/s2-052.htmlMitigationVendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9805US Government Resource
https://www.exploit-db.com/exploits/42627/ExploitThird Party AdvisoryVDB Entry
https://www.kb.cert.org/vuls/id/112992Third Party AdvisoryUS Government Resource

and 3 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2017-9805 being actively exploited?

Yes. CVE-2017-9805 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Nov 2021.

How severe is CVE-2017-9805?

CVE-2017-9805 has a CVSS 3.1 base score of 8.1, rated high. EPSS estimates a 99.4% probability of exploitation.

Which products are affected by CVE-2017-9805?

Affected products include Apache Struts, Cisco Digital Media Manager, Cisco Hosted Collaboration Solution, Cisco Media Experience Engine, Cisco Network Performance Analysis, and 2 more.

How do I fix CVE-2017-9805?

Upgrade affected software to a fixed version, for example Apache Struts 2.3.34 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2017-9805 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.