CVSS 3.0
6.2 mediumCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2017-15707
In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.
Severity
- EPSS
- 4.9% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:struts
- netapp:oncommand_balance
- oracle:agile_plm_framework
- oracle:enterprise_manager_for_virtualization
- oracle:financial_services_hedge_management_and_ifrs_valuations
- oracle:financial_services_market_risk_measurement_and_management
- oracle:global_lifecycle_management_opatchauto
- oracle:jd_edwards_enterpriseone_tools
- oracle:retail_order_broker
- oracle:retail_xstore_point_of_service
- oracle:webcenter_portal
- oracle:weblogic_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xcrm-qpp8-hcw4 | Maven | org.apache.struts:struts2-rest-plugin | >=2.5.0 <2.5.16 | 2.5.16 |