ByteOS Network

Vulnerability Details :

CVE-2017-9805

Assigner-apache

Assigner Org ID-f0158376-9dc2-43b6-827c-5f631a4d8d09

Published At-15 Sep, 2017 | 19:00

Updated At-30 Jul, 2025 | 01:46

Apache Struts Deserialization of Untrusted Data Vulnerability

Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Known Exploited Vulnerabilities (KEV)

cisa.gov

Vendor:

The Apache Software Foundation

Product:Struts

Added At:03 Nov, 2021

Due At:03 May, 2022

Apache Struts Deserialization of Untrusted Data Vulnerability

Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.

Used in Ransomware

Unknown

CWE

CWE-502

Required Action:

Apply updates per vendor instructions.

Additional Notes:

https://nvd.nist.gov/vuln/detail/CVE-2017-9805

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:apache

Assigner Org ID:f0158376-9dc2-43b6-827c-5f631a4d8d09

Published At:15 Sep, 2017 | 19:00

Updated At:30 Jul, 2025 | 01:46

▼CVE Numbering Authority (CNA)

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

Affected Products

Vendor

The Apache Software Foundation

Product

Apache Struts

Versions

Affected

Apache Struts before 2.3.34 and 2.5.x before 2.5.13

Problem Types

Type	CWE ID	Description
text	N/A	RCE

Type: text

CWE ID: N/A

Description: RCE

References

Hyperlink	Resource
http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html	x_refsource_CONFIRM
https://struts.apache.org/docs/s2-052.html	x_refsource_CONFIRM
http://www.securitytracker.com/id/1039263	vdb-entry x_refsource_SECTRACK
http://www.securityfocus.com/bid/100609	vdb-entry x_refsource_BID
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2	vendor-advisory x_refsource_CISCO
https://bugzilla.redhat.com/show_bug.cgi?id=1488482	x_refsource_CONFIRM
https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax	x_refsource_CONFIRM
https://www.exploit-db.com/exploits/42627/	exploit x_refsource_EXPLOIT-DB
https://lgtm.com/blog/apache_struts_CVE-2017-9805	x_refsource_MISC
https://cwiki.apache.org/confluence/display/WW/S2-052	x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-20170907-0001/	x_refsource_CONFIRM
https://www.kb.cert.org/vuls/id/112992	third-party-advisory x_refsource_CERT-VN

Hyperlink: http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html

Resource:

x_refsource_CONFIRM

Hyperlink: https://struts.apache.org/docs/s2-052.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.securitytracker.com/id/1039263

Resource:

vdb-entry

x_refsource_SECTRACK

Hyperlink: http://www.securityfocus.com/bid/100609

Resource:

vdb-entry

x_refsource_BID

Hyperlink: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2

Resource:

vendor-advisory

x_refsource_CISCO

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=1488482

Resource:

x_refsource_CONFIRM

Hyperlink: https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax

Resource:

x_refsource_CONFIRM

Hyperlink: https://www.exploit-db.com/exploits/42627/

Resource:

exploit

x_refsource_EXPLOIT-DB

Hyperlink: https://lgtm.com/blog/apache_struts_CVE-2017-9805

Resource:

x_refsource_MISC

Hyperlink: https://cwiki.apache.org/confluence/display/WW/S2-052

Resource:

x_refsource_CONFIRM

Hyperlink: https://security.netapp.com/advisory/ntap-20170907-0001/

Resource:

x_refsource_CONFIRM

Hyperlink: https://www.kb.cert.org/vuls/id/112992

Resource:

third-party-advisory

x_refsource_CERT-VN

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html	x_refsource_CONFIRM x_transferred
https://struts.apache.org/docs/s2-052.html	x_refsource_CONFIRM x_transferred
http://www.securitytracker.com/id/1039263	vdb-entry x_refsource_SECTRACK x_transferred
http://www.securityfocus.com/bid/100609	vdb-entry x_refsource_BID x_transferred
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2	vendor-advisory x_refsource_CISCO x_transferred
https://bugzilla.redhat.com/show_bug.cgi?id=1488482	x_refsource_CONFIRM x_transferred
https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax	x_refsource_CONFIRM x_transferred
https://www.exploit-db.com/exploits/42627/	exploit x_refsource_EXPLOIT-DB x_transferred
https://lgtm.com/blog/apache_struts_CVE-2017-9805	x_refsource_MISC x_transferred
https://cwiki.apache.org/confluence/display/WW/S2-052	x_refsource_CONFIRM x_transferred
https://security.netapp.com/advisory/ntap-20170907-0001/	x_refsource_CONFIRM x_transferred
https://www.kb.cert.org/vuls/id/112992	third-party-advisory x_refsource_CERT-VN x_transferred

Hyperlink: http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://struts.apache.org/docs/s2-052.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.securitytracker.com/id/1039263

Resource:

vdb-entry

x_refsource_SECTRACK

x_transferred

Hyperlink: http://www.securityfocus.com/bid/100609

Resource:

vdb-entry

x_refsource_BID

x_transferred

Hyperlink: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2

Resource:

vendor-advisory

x_refsource_CISCO

x_transferred

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=1488482

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://www.exploit-db.com/exploits/42627/

Resource:

exploit

x_refsource_EXPLOIT-DB

x_transferred

Hyperlink: https://lgtm.com/blog/apache_struts_CVE-2017-9805

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://cwiki.apache.org/confluence/display/WW/S2-052

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://security.netapp.com/advisory/ntap-20170907-0001/

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://www.kb.cert.org/vuls/id/112992

Resource:

third-party-advisory

x_refsource_CERT-VN

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-502	CWE-502 Deserialization of Untrusted Data

Type: CWE

CWE ID: CWE-502

Description: CWE-502 Deserialization of Untrusted Data

Metrics

Version	Base score	Base severity	Vector
3.1	8.1	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 8.1

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Metrics Other Info

kev

dateAdded:

2021-11-03

reference:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9805

Timeline

Event	Date
CVE-2017-9805 added to CISA KEV	2021-11-03 00:00:00

Event: CVE-2017-9805 added to CISA KEV

Date: 2021-11-03 00:00:00

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:security@apache.org

Published At:15 Sep, 2017 | 19:29

Updated At:20 Apr, 2025 | 01:37

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2021-11-03	2022-05-03	Apache Struts Deserialization of Untrusted Data Vulnerability	Apply updates per vendor instructions.

Date Added: 2021-11-03

Due Date: 2022-05-03

Vulnerability Name: Apache Struts Deserialization of Untrusted Data Vulnerability

Required Action: Apply updates per vendor instructions.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.1	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	8.1	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P

Type: Primary

Version: 3.1

Base score: 8.1

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 8.1

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 6.8

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:P/I:P/A:P

CPE Matches

The Apache Software Foundation

>>struts>>Versions from 2.1.2(inclusive) to 2.3.34(exclusive)

cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*

The Apache Software Foundation

>>struts>>Versions from 2.5.0(inclusive) to 2.5.13(exclusive)

cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>digital_media_manager>>-

cpe:2.3:a:cisco:digital_media_manager:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>hosted_collaboration_solution>>10.5\(1\)

cpe:2.3:a:cisco:hosted_collaboration_solution:10.5\(1\):*:*:*:*:*:*:*

Cisco Systems, Inc.

>>hosted_collaboration_solution>>11.0\(1\)

cpe:2.3:a:cisco:hosted_collaboration_solution:11.0\(1\):*:*:*:*:*:*:*

Cisco Systems, Inc.

>>hosted_collaboration_solution>>11.5\(1\)

cpe:2.3:a:cisco:hosted_collaboration_solution:11.5\(1\):*:*:*:*:*:*:*

Cisco Systems, Inc.

>>hosted_collaboration_solution>>11.6\(1\)

cpe:2.3:a:cisco:hosted_collaboration_solution:11.6\(1\):*:*:*:*:*:*:*

Cisco Systems, Inc.

>>media_experience_engine>>3.5

cpe:2.3:a:cisco:media_experience_engine:3.5:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>media_experience_engine>>3.5.2

cpe:2.3:a:cisco:media_experience_engine:3.5.2:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>network_performance_analysis>>-

cpe:2.3:a:cisco:network_performance_analysis:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>video_distribution_suite_for_internet_streaming>>-

cpe:2.3:a:cisco:video_distribution_suite_for_internet_streaming:-:*:*:*:*:*:*:*

NetApp, Inc.

>>oncommand_balance>>-

cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-502	Primary	nvd@nist.gov
CWE-502	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-502

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-502

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html	security@apache.org	Patch Third Party Advisory
http://www.securityfocus.com/bid/100609	security@apache.org	Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1039263	security@apache.org	Broken Link Third Party Advisory VDB Entry
https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax	security@apache.org	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1488482	security@apache.org	Issue Tracking Third Party Advisory VDB Entry
https://cwiki.apache.org/confluence/display/WW/S2-052	security@apache.org	Mitigation Vendor Advisory
https://lgtm.com/blog/apache_struts_CVE-2017-9805	security@apache.org	Broken Link
https://security.netapp.com/advisory/ntap-20170907-0001/	security@apache.org	Third Party Advisory
https://struts.apache.org/docs/s2-052.html	security@apache.org	Mitigation Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2	security@apache.org	Third Party Advisory
https://www.exploit-db.com/exploits/42627/	security@apache.org	Exploit Third Party Advisory VDB Entry
https://www.kb.cert.org/vuls/id/112992	security@apache.org	Third Party Advisory US Government Resource
http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html	af854a3a-2127-422b-91ae-364da2661108	Patch Third Party Advisory
http://www.securityfocus.com/bid/100609	af854a3a-2127-422b-91ae-364da2661108	Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1039263	af854a3a-2127-422b-91ae-364da2661108	Broken Link Third Party Advisory VDB Entry
https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1488482	af854a3a-2127-422b-91ae-364da2661108	Issue Tracking Third Party Advisory VDB Entry
https://cwiki.apache.org/confluence/display/WW/S2-052	af854a3a-2127-422b-91ae-364da2661108	Mitigation Vendor Advisory
https://lgtm.com/blog/apache_struts_CVE-2017-9805	af854a3a-2127-422b-91ae-364da2661108	Broken Link
https://security.netapp.com/advisory/ntap-20170907-0001/	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://struts.apache.org/docs/s2-052.html	af854a3a-2127-422b-91ae-364da2661108	Mitigation Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://www.exploit-db.com/exploits/42627/	af854a3a-2127-422b-91ae-364da2661108	Exploit Third Party Advisory VDB Entry
https://www.kb.cert.org/vuls/id/112992	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory US Government Resource

Hyperlink: http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html

Source: security@apache.org

Resource:

Patch

Third Party Advisory

Hyperlink: http://www.securityfocus.com/bid/100609

Source: security@apache.org

Resource:

Broken Link

Third Party Advisory

VDB Entry

Hyperlink: http://www.securitytracker.com/id/1039263

Source: security@apache.org

Resource:

Broken Link

Third Party Advisory

VDB Entry

Hyperlink: https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax

Source: security@apache.org

Resource:

Vendor Advisory

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=1488482

Source: security@apache.org

Resource:

Issue Tracking

Third Party Advisory

VDB Entry

Hyperlink: https://cwiki.apache.org/confluence/display/WW/S2-052

Source: security@apache.org

Resource:

Mitigation

Vendor Advisory

Hyperlink: https://lgtm.com/blog/apache_struts_CVE-2017-9805

Source: security@apache.org

Resource:

Broken Link

Hyperlink: https://security.netapp.com/advisory/ntap-20170907-0001/

Source: security@apache.org

Resource:

Third Party Advisory

Hyperlink: https://struts.apache.org/docs/s2-052.html

Source: security@apache.org

Resource:

Mitigation

Vendor Advisory

Hyperlink: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2

Source: security@apache.org

Resource:

Third Party Advisory

Hyperlink: https://www.exploit-db.com/exploits/42627/

Source: security@apache.org

Resource:

Exploit

Third Party Advisory

VDB Entry

Hyperlink: https://www.kb.cert.org/vuls/id/112992

Source: security@apache.org

Resource:

Third Party Advisory

US Government Resource

Hyperlink: http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html