medium6.2
CVE-2017-15707
Moderate severity vulnerability that affects org.apache.struts:struts2-rest-plugin
Impact
In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.struts:struts2-rest-plugin | >= 2.5.0, <= 2.5.14 | 2.5.16 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Struts | from 2.5 through 2.5.14 |
| Netapp | Oncommand Balance | All versions |
| Oracle | Agile Plm Framework | Version 9.3.6 |
| Oracle | Enterprise Manager For Virtualization | Versions 13.2.2, 13.2.3 |
| Oracle | Financial Services Hedge Management And Ifrs Valuations | Versions 8.0.4, 8.0.5 |
| Oracle | Financial Services Market Risk Measurement And Management | Version 8.0.5 |
| Oracle | Global Lifecycle Management Opatchauto | All versions |
| Oracle | Jd Edwards Enterpriseone Tools | Version 9.2 |
| Oracle | Retail Order Broker | Version 5.2 |
| Oracle | Retail Xstore Point Of Service | Versions 6.5.11, 7.0.6, 7.1.6, 15.0.1, 16.0.2 |
| Oracle | Webcenter Portal | Versions 12.2.1.2.0, 12.2.1.3.0 |
| Oracle | Weblogic Server | Versions 12.2.1.2, 12.2.1.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.securityfocus.com/bid/102021
- http://www.securitytracker.com/id/1039946
- https://cwiki.apache.org/confluence/display/WW/S2-054
- https://security.netapp.com/advisory/ntap-20171214-0001/
- https://github.com/advisories/GHSA-xcrm-qpp8-hcw4
- https://nvd.nist.gov/vuln/detail/CVE-2017-15707