Paper/Archive/CVE-2017-9791

CVE-2017-9791

Apache Software Foundation Apache Struts — Apache Struts 1 Improper Input Validation Vulnerability

KEV · due 10 Aug EPSS 99%public exploit SSVC act CVSS 9.8

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 In CISA KEV+3030.0 EPSS percentile 99.9.999 × 2020.0 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

Affected

ProductAffectedFixed inSource

Apache Struts2.1.x series–CNA

Apache Struts2.3.x series–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

reforacle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html refsecurityfocus.com/bid/99484 exploitexploit-db.com/exploits/42324 refstruts.apache.org/docs/s2-048.html refsecuritytracker.com/id/1038838 exploitexploit-db.com/exploits/44643 refsecurity.netapp.com/advisory/ntap-20180706-0002 refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9791 kevcisa.gov/known-exploited-vulnerabilities-catalog