CVE-2017-9805
- State
- Published
- Severity
- 8.1 High
- Published
- Sep 15, 2017
- Updated
- Oct 21, 2025
- Reserved
- Jun 21, 2017
Description
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-502 Deserialization of Untrusted Data
Affected Products
| Product | Versions |
|---|---|
Apache StrutsApache Software Foundation |
|
References
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
- https://struts.apache.org/docs/s2-052.html
- 1039263vdb-entry
- 100609vdb-entry
- 20170907 Multiple Vulnerabilities in Apache Struts 2 Affecting Cisco Products: September 2017vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1488482
- https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax
- 42627exploit
- https://lgtm.com/blog/apache_struts_CVE-2017-9805
- https://cwiki.apache.org/confluence/display/WW/S2-052
- https://security.netapp.com/advisory/ntap-20170907-0001/
- VU#112992third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9805government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.