In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.
References
Link | Resource |
---|---|
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html | Patch |
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html | Patch |
http://www.securityfocus.com/bid/102021 | Third Party Advisory VDB Entry |
http://www.securitytracker.com/id/1039946 | Third Party Advisory VDB Entry |
https://cwiki.apache.org/confluence/display/WW/S2-054 | Patch Vendor Advisory |
https://security.netapp.com/advisory/ntap-20171214-0001/ | Third Party Advisory |
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html | Patch |
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html | Patch |
http://www.securityfocus.com/bid/102021 | Third Party Advisory VDB Entry |
http://www.securitytracker.com/id/1039946 | Third Party Advisory VDB Entry |
https://cwiki.apache.org/confluence/display/WW/S2-054 | Patch Vendor Advisory |
https://security.netapp.com/advisory/ntap-20171214-0001/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
21 Nov 2024, 03:15
Type | Values Removed | Values Added |
---|---|---|
References | () http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html - Patch | |
References | () http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - Patch | |
References | () http://www.securityfocus.com/bid/102021 - Third Party Advisory, VDB Entry | |
References | () http://www.securitytracker.com/id/1039946 - Third Party Advisory, VDB Entry | |
References | () https://cwiki.apache.org/confluence/display/WW/S2-054 - Patch, Vendor Advisory | |
References | () https://security.netapp.com/advisory/ntap-20171214-0001/ - Third Party Advisory |
Information
Published : 2017-12-01 16:29
Updated : 2024-11-21 03:15
NVD link : CVE-2017-15707
Mitre link : CVE-2017-15707
CVE.ORG link : CVE-2017-15707
JSON object : View
Products Affected
oracle
- agile_plm_framework
- financial_services_hedge_management_and_ifrs_valuations
- weblogic_server
- global_lifecycle_management_opatchauto
- retail_order_broker
- webcenter_portal
- jd_edwards_enterpriseone_tools
- financial_services_market_risk_measurement_and_management
- retail_xstore_point_of_service
- enterprise_manager_for_virtualization
apache
- struts
netapp
- oncommand_balance
CWE
CWE-20
Improper Input Validation