Umbra Wiki cve cve/CVE-2017-9805
Back to wiki

CVE-2017-9805 — Apache Struts Deserialization of Untrusted Data Vulnerability

provenance: imported · CVE: CVE-2017-9805

CVE-2017-9805: Apache Struts Deserialization of Untrusted Data Vulnerability

CISA Known Exploited Vulnerability (KEV)

Vendor / project Apache
Product Struts
Date added 2021-11-03
Due date 2022-05-03
Ransomware campaign use Unknown

Description

Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.

Required action (CISA)

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2017-9805

References

  • NVD: https://nvd.nist.gov/vuln/detail/CVE-2017-9805
  • KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog