CVE-2017-9791

Опубликовано: 10 июл. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Критический

Описание

The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

Ссылки

http://struts.apache.org/docs/s2-048.html
Mitigation
Vendor Advisory
http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
Patch
Third Party Advisory
http://www.securityfocus.com/bid/99484
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1038838
Third Party Advisory
VDB Entry
https://security.netapp.com/advisory/ntap-20180706-0002/
Third Party Advisory
https://www.exploit-db.com/exploits/42324/
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/44643/
Third Party Advisory
VDB Entry
http://struts.apache.org/docs/s2-048.html
Mitigation
Vendor Advisory
http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
Patch
Third Party Advisory
http://www.securityfocus.com/bid/99484
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1038838
Third Party Advisory
VDB Entry
https://security.netapp.com/advisory/ntap-20180706-0002/
Third Party Advisory
https://www.exploit-db.com/exploits/42324/
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/44643/
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.20.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.31:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.32:*:*:*:*:*:*:*

EPSS

Процентиль: 100%

0.94263

Критический

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-20

Связанные уязвимости

CVE-2017-9791

CVSS3: 9.8

ubuntu

около 8 лет назад

The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

CVE-2017-9791

CVSS3: 8.1

redhat

около 8 лет назад

The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

CVE-2017-9791

CVSS3: 9.8

debian

около 8 лет назад

The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remot ...

GHSA-29rm-6752-gvwv

CVSS3: 9.8

github

больше 3 лет назад

Code execution in Apache Struts 1 plugin

BDU:2017-02059

fstec

около 8 лет назад

Уязвимость плагина Struts 1 программной платформы Apache Struts, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 100%

0.94263

Критический

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-20