← Back

CVE-2017-9791

nvd nistnuclei
Published: Jul 10, 2017Modified: Apr 21, 2026CISA KEV

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

Affected (33)

Products: Apache: Struts
Apache
1 product
Struts
Configuration A
33 vulnerable
Vulnerable SoftwareAffected Versions
Apache
Struts
Version 2.3.1.1
Struts
Version 2.3.1.2
Struts
Version 2.3.12
Struts
Version 2.3.14.1
Struts
Version 2.3.14.2
Struts
Version 2.3.14.3
Struts
Version 2.3.14
Struts
Version 2.3.15.1
Struts
Version 2.3.15.2
Struts
Version 2.3.15.3
Struts
Version 2.3.15
Struts
Version 2.3.16.1
Struts
Version 2.3.16.2
Struts
Version 2.3.16.3
Struts
Version 2.3.16
Struts
Version 2.3.1
Struts
Version 2.3.20.1
Struts
Version 2.3.20.3
Struts
Version 2.3.20
Struts
Version 2.3.24.1
Struts
Version 2.3.24.3
Struts
Version 2.3.24
Struts
Version 2.3.28.1
Struts
Version 2.3.28
Struts
Version 2.3.29
Struts
Version 2.3.30
Struts
Version 2.3.31
Struts
Version 2.3.32
Struts
Version 2.3.3
Struts
Version 2.3.4.1
Struts
Version 2.3.4
Struts
Version 2.3.7
Struts
Version 2.3.8

Related CWEs

CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (15)

Source: security@apache.org
MitigationVendor Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
Third Party AdvisoryVDB EntryBroken Link
Source: security@apache.org
Third Party AdvisoryVDB EntryBroken Link
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
Third Party AdvisoryVDB Entry
Source: security@apache.org
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
MitigationVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB EntryBroken Link
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB EntryBroken Link
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.