Vendor / Project: Apache Product: Struts Description: Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads. Required Action: Apply updates per vendor instructions. Due Date: 2022-05-03 Ransomware Campaign Use: Unknown CWEs: CWE-502 Notes: https://nvd.nist.gov/vuln/detail/CVE-2017-9805
CVE-2017-9805 — Apache Struts Deserialization of Untrusted Data Vulnerability
Kurzinfo
Metadaten
- Original (extern): Link oeffnen
- Veroeffentlicht: 2021-11-03 00:00 UTC
- Importiert: 2026-10-20 22:46 UTC
- CVSS: 8.1
- Quelle-ID:
cisa_kev - uid_hash:
a458833f0f7eb02f6d13cc4fcd47b87c043061e1316cdaeeb0b52bf743e0126a
Inhalt
Verknuepfte CVEs
| CVE-ID | Severity (Quelle) | CVSS (Quelle) | Severity (CVE.org) | CVSS (CVE.org) | EPSS | EPSS-Pctl | Veroeffentlicht (CVE.org) |
|---|---|---|---|---|---|---|---|
HIGH |
8.1 |
HIGH |
8.1 |
2017-09-15 |
Quellen-Details
| Bezeichnung | Name | Kategorie | Tags | Zielgruppe | Sprache | Feed-URL |
|---|---|---|---|---|---|---|
| CISA – Known Exploited Vulnerabilities (KEV) | threat_intel | cisa, kev | - | de | https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json |