CVE-2017-9805

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2017-9805
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html Patch Third Party Advisory
http://www.securityfocus.com/bid/100609 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1039263 Broken Link Third Party Advisory VDB Entry
https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1488482 Issue Tracking Third Party Advisory VDB Entry
https://cwiki.apache.org/confluence/display/WW/S2-052 Mitigation Vendor Advisory
https://lgtm.com/blog/apache_struts_CVE-2017-9805 Broken Link
https://security.netapp.com/advisory/ntap-20170907-0001/ Third Party Advisory
https://struts.apache.org/docs/s2-052.html Mitigation Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2 Third Party Advisory
https://www.exploit-db.com/exploits/42627/ Exploit Third Party Advisory VDB Entry
https://www.kb.cert.org/vuls/id/112992 Third Party Advisory US Government Resource
http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html Patch Third Party Advisory
http://www.securityfocus.com/bid/100609 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1039263 Broken Link Third Party Advisory VDB Entry
https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1488482 Issue Tracking Third Party Advisory VDB Entry
https://cwiki.apache.org/confluence/display/WW/S2-052 Mitigation Vendor Advisory
https://lgtm.com/blog/apache_struts_CVE-2017-9805 Broken Link
https://security.netapp.com/advisory/ntap-20170907-0001/ Third Party Advisory
https://struts.apache.org/docs/s2-052.html Mitigation Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2 Third Party Advisory
https://www.exploit-db.com/exploits/42627/ Exploit Third Party Advisory VDB Entry
https://www.kb.cert.org/vuls/id/112992 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:cisco:digital_media_manager:-:*:*:*:*:*:*:*
cpe:2.3:a:cisco:hosted_collaboration_solution:10.5\(1\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:hosted_collaboration_solution:11.0\(1\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:hosted_collaboration_solution:11.5\(1\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:hosted_collaboration_solution:11.6\(1\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:media_experience_engine:3.5:*:*:*:*:*:*:*
cpe:2.3:a:cisco:media_experience_engine:3.5.2:*:*:*:*:*:*:*
cpe:2.3:a:cisco:network_performance_analysis:-:*:*:*:*:*:*:*
cpe:2.3:a:cisco:video_distribution_suite_for_internet_streaming:-:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*
History

21 Nov 2024, 03:36

Type Values Removed Values Added
References () http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html - Patch, Third Party Advisory () http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html - Patch, Third Party Advisory
References () http://www.securityfocus.com/bid/100609 - Broken Link, Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/100609 - Broken Link, Third Party Advisory, VDB Entry
References () http://www.securitytracker.com/id/1039263 - Broken Link, Third Party Advisory, VDB Entry () http://www.securitytracker.com/id/1039263 - Broken Link, Third Party Advisory, VDB Entry
References () https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax - Vendor Advisory () https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax - Vendor Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=1488482 - Issue Tracking, Third Party Advisory, VDB Entry () https://bugzilla.redhat.com/show_bug.cgi?id=1488482 - Issue Tracking, Third Party Advisory, VDB Entry
References () https://cwiki.apache.org/confluence/display/WW/S2-052 - Mitigation, Vendor Advisory () https://cwiki.apache.org/confluence/display/WW/S2-052 - Mitigation, Vendor Advisory
References () https://lgtm.com/blog/apache_struts_CVE-2017-9805 - Broken Link () https://lgtm.com/blog/apache_struts_CVE-2017-9805 - Broken Link
References () https://security.netapp.com/advisory/ntap-20170907-0001/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20170907-0001/ - Third Party Advisory
References () https://struts.apache.org/docs/s2-052.html - Mitigation, Vendor Advisory () https://struts.apache.org/docs/s2-052.html - Mitigation, Vendor Advisory
References () https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2 - Third Party Advisory () https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2 - Third Party Advisory
References () https://www.exploit-db.com/exploits/42627/ - Exploit, Third Party Advisory, VDB Entry () https://www.exploit-db.com/exploits/42627/ - Exploit, Third Party Advisory, VDB Entry
References () https://www.kb.cert.org/vuls/id/112992 - Third Party Advisory, US Government Resource () https://www.kb.cert.org/vuls/id/112992 - Third Party Advisory, US Government Resource

25 Jul 2024, 13:40

Type Values Removed Values Added
CPE cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.5.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.5.8:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.5.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.5.10:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.5.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.5.9:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.32:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.31:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.5.6:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.33:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.5.10.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.5.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.5.7:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.5.11:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.20.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.5.5:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.5.12:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*		 cpe:2.3:a:cisco:hosted_collaboration_solution:11.0\(1\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:network_performance_analysis:-:*:*:*:*:*:*:*
cpe:2.3:a:cisco:hosted_collaboration_solution:11.6\(1\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:video_distribution_suite_for_internet_streaming:-:*:*:*:*:*:*:*
cpe:2.3:a:cisco:media_experience_engine:3.5.2:*:*:*:*:*:*:*
cpe:2.3:a:cisco:hosted_collaboration_solution:10.5\(1\):*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*
cpe:2.3:a:cisco:digital_media_manager:-:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:media_experience_engine:3.5:*:*:*:*:*:*:*
cpe:2.3:a:cisco:hosted_collaboration_solution:11.5\(1\):*:*:*:*:*:*:*
First Time Cisco media Experience Engine
Cisco hosted Collaboration Solution
Netapp oncommand Balance
Cisco
Netapp
Cisco digital Media Manager
Cisco video Distribution Suite For Internet Streaming
Cisco network Performance Analysis
References () http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html - Third Party Advisory () http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html - Patch, Third Party Advisory
References () http://www.securityfocus.com/bid/100609 - Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/100609 - Broken Link, Third Party Advisory, VDB Entry
References () http://www.securitytracker.com/id/1039263 - Third Party Advisory, VDB Entry () http://www.securitytracker.com/id/1039263 - Broken Link, Third Party Advisory, VDB Entry
References () https://lgtm.com/blog/apache_struts_CVE-2017-9805 - () https://lgtm.com/blog/apache_struts_CVE-2017-9805 - Broken Link
References () https://security.netapp.com/advisory/ntap-20170907-0001/ - () https://security.netapp.com/advisory/ntap-20170907-0001/ - Third Party Advisory
References () https://struts.apache.org/docs/s2-052.html - Vendor Advisory () https://struts.apache.org/docs/s2-052.html - Mitigation, Vendor Advisory
References () https://www.exploit-db.com/exploits/42627/ - Third Party Advisory, VDB Entry () https://www.exploit-db.com/exploits/42627/ - Exploit, Third Party Advisory, VDB Entry
References () https://www.kb.cert.org/vuls/id/112992 - () https://www.kb.cert.org/vuls/id/112992 - Third Party Advisory, US Government Resource
Information

Published : 2017-09-15 19:29

Updated : 2025-02-06 22:15

NVD link : CVE-2017-9805

Mitre link : CVE-2017-9805

CVE.ORG link : CVE-2017-9805

JSON object : View

Products Affected

cisco

  • video_distribution_suite_for_internet_streaming
  • hosted_collaboration_solution
  • digital_media_manager
  • network_performance_analysis
  • media_experience_engine

apache

  • struts

netapp

  • oncommand_balance
CWE
CWE-502

Deserialization of Untrusted Data