CVSS 3.1
8.1 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2017-9805
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
Severity
- EPSS
- 99% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2021-11-03, due 2022-05-03
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:struts
- cisco:digital_media_manager
- cisco:hosted_collaboration_solution
- cisco:media_experience_engine
- cisco:network_performance_analysis
- cisco:video_distribution_suite_for_internet_streaming
- netapp:oncommand_balance
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-gg9m-fj3v-r58c | Maven | org.apache.struts:struts2-rest-plugin | >=2.1.1 <2.3.34 | 2.3.34 |
| GHSA-gg9m-fj3v-r58c | Maven | org.apache.struts:struts2-rest-plugin | >=2.5.0 <2.5.13 | 2.5.13 |