The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
25 Jul 2024, 13:40
Type | Values Removed | Values Added |
---|---|---|
References | () http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html - Patch, Third Party Advisory | |
References | () http://www.securityfocus.com/bid/100609 - Broken Link, Third Party Advisory, VDB Entry | |
References | () http://www.securitytracker.com/id/1039263 - Broken Link, Third Party Advisory, VDB Entry | |
References | () https://lgtm.com/blog/apache_struts_CVE-2017-9805 - Broken Link | |
References | () https://security.netapp.com/advisory/ntap-20170907-0001/ - Third Party Advisory | |
References | () https://struts.apache.org/docs/s2-052.html - Mitigation, Vendor Advisory | |
References | () https://www.exploit-db.com/exploits/42627/ - Exploit, Third Party Advisory, VDB Entry | |
References | () https://www.kb.cert.org/vuls/id/112992 - Third Party Advisory, US Government Resource | |
First Time |
Cisco video Distribution Suite For Internet Streaming
Cisco Cisco hosted Collaboration Solution Cisco digital Media Manager Cisco media Experience Engine Netapp oncommand Balance Cisco network Performance Analysis Netapp |
|
CPE | cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.33:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.20.3:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.31:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.5.3:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.5.9:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.5.4:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.5.8:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.5.2:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.5.10:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.5.12:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.32:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.5.5:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.5.7:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.5.1:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.5.6:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.5.10.1:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:* cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:* |
cpe:2.3:a:cisco:video_distribution_suite_for_internet_streaming:-:*:*:*:*:*:*:* cpe:2.3:a:cisco:network_performance_analysis:-:*:*:*:*:*:*:* cpe:2.3:a:cisco:hosted_collaboration_solution:10.5\(1\):*:*:*:*:*:*:* cpe:2.3:a:cisco:media_experience_engine:3.5:*:*:*:*:*:*:* cpe:2.3:a:cisco:hosted_collaboration_solution:11.0\(1\):*:*:*:*:*:*:* cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* cpe:2.3:a:cisco:hosted_collaboration_solution:11.6\(1\):*:*:*:*:*:*:* cpe:2.3:a:cisco:hosted_collaboration_solution:11.5\(1\):*:*:*:*:*:*:* cpe:2.3:a:cisco:digital_media_manager:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:* cpe:2.3:a:cisco:media_experience_engine:3.5.2:*:*:*:*:*:*:* |
Information
Published : 2017-09-15 19:29
Updated : 2024-07-25 13:40
NVD link : CVE-2017-9805
Mitre link : CVE-2017-9805
CVE.ORG link : CVE-2017-9805
JSON object : View
Products Affected
cisco
- media_experience_engine
- video_distribution_suite_for_internet_streaming
- hosted_collaboration_solution
- network_performance_analysis
- digital_media_manager
apache
- struts
netapp
- oncommand_balance
CWE
CWE-502
Deserialization of Untrusted Data