What’s Vulnerable › Vulnerabilities

CVE-2017-9805: Apache Struts Deserialization of Untrusted Data Vulnerability

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2021-11-03
• EPSS: 99.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-09-15 · updated 2026-06-17
• Weakness: CWE-502

Description

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

Affected products

• Apache Struts: from 2.1.2 before 2.3.34; from 2.5.0 before 2.5.13 — fixed in 2.3.34, 2.5.13
• Cisco Digital Media Manager: all versions
• Cisco Hosted Collaboration Solution: 10.5(1), 11.0(1), 11.5(1), 11.6(1)
• Cisco Media Experience Engine: 3.5, 3.5.2
• Cisco Network Performance Analysis: all versions
• Cisco Video Distribution Suite For Internet Streaming: all versions
• NetApp Oncommand Balance: all versions

How to fix

Upgrade to a fixed version: Apache Struts 2.3.34, 2.5.13. Check the vendor advisory for mitigations.

References

• http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
• http://www.securityfocus.com/bid/100609
• http://www.securitytracker.com/id/1039263
• https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax
• https://bugzilla.redhat.com/show_bug.cgi?id=1488482
• https://cwiki.apache.org/confluence/display/WW/S2-052
• https://lgtm.com/blog/apache_struts_CVE-2017-9805
• https://security.netapp.com/advisory/ntap-20170907-0001/
• https://struts.apache.org/docs/s2-052.html
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2
• https://www.exploit-db.com/exploits/42627/
• https://www.kb.cert.org/vuls/id/112992

Get alerted when CVE-2017-9805 or the next vulnerability affects your stack