In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.
References
Link | Resource |
---|---|
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html | Patch |
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html | Patch |
http://www.securityfocus.com/bid/102021 | Third Party Advisory VDB Entry |
http://www.securitytracker.com/id/1039946 | Third Party Advisory VDB Entry |
https://cwiki.apache.org/confluence/display/WW/S2-054 | Patch Vendor Advisory |
https://security.netapp.com/advisory/ntap-20171214-0001/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
No history.
Information
Published : 2017-12-01 16:29
Updated : 2024-02-28 16:04
NVD link : CVE-2017-15707
Mitre link : CVE-2017-15707
CVE.ORG link : CVE-2017-15707
JSON object : View
Products Affected
netapp
- oncommand_balance
oracle
- retail_order_broker
- global_lifecycle_management_opatchauto
- jd_edwards_enterpriseone_tools
- retail_xstore_point_of_service
- agile_plm_framework
- financial_services_hedge_management_and_ifrs_valuations
- weblogic_server
- financial_services_market_risk_measurement_and_management
- enterprise_manager_for_virtualization
- webcenter_portal
apache
- struts
CWE
CWE-20
Improper Input Validation