[ CVE-2017-9791 · Published 10 Jul 2017 ]
Apache Struts 1 Improper Input Validation Vulnerability
Exploited · CISA KEV CVSS 9.8
EPSS 99%Fix available
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-02-10
- EPSS: 99% chance of exploitation in the next 30 days (higher than 100% of CVEs)
- Critical severity: CVSS 9.8
[ Description ]Official description
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
CISA: The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 10 Aug 2022): Apply updates per vendor instructions.
- Patch on oracle.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ References ]References
- struts.apache.org/docs/s2-048.htmlMitigationVendor Advisory
- www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.htmlPatchThird Party Advisory
- www.securityfocus.com/bid/99484Broken LinkThird Party AdvisoryVDB Entry
- www.securitytracker.com/id/1038838Broken LinkThird Party AdvisoryVDB Entry
- security.netapp.com/advisory/ntap-20180706-0002Third Party Advisory
- www.exploit-db.com/exploits/42324Third Party AdvisoryVDB Entry
- www.exploit-db.com/exploits/44643Third Party AdvisoryVDB Entry
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource