critical9.8Known exploitedPublic exploit code
CVE-2017-9791
Apache Struts 1 Improper Input Validation Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-02-10. Federal due date: 2022-08-10.
Apply updates per vendor instructions.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Apache Struts 2 - Struts 1 Plugin Showcase OGNL Code Execution (Metasploit)2018-05-17 · remote · multiple · Verified
- Apache Struts 2.3.x Showcase - Remote Code Execution2017-07-07 · webapps · multiple · Verified
Impact
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Struts | Versions 2.3.1, 2.3.1.1, 2.3.1.2, 2.3.3, 2.3.4, 2.3.4.1 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://struts.apache.org/docs/s2-048.html
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
- http://www.securityfocus.com/bid/99484
- http://www.securitytracker.com/id/1038838
- https://security.netapp.com/advisory/ntap-20180706-0002/
- https://www.exploit-db.com/exploits/42324/
- https://www.exploit-db.com/exploits/44643/
- http://struts.apache.org/docs/s2-048.html
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
- http://www.securityfocus.com/bid/99484
- http://www.securitytracker.com/id/1038838
- https://security.netapp.com/advisory/ntap-20180706-0002/
- https://www.exploit-db.com/exploits/42324/
- https://www.exploit-db.com/exploits/44643/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9791