Actively exploited · Published Jul 10, 2017 · Assigned by apache

CVE-2017-9791

Critical 9.8 Exploited

In plain English

A critical-severity improper input validation in Apache Struts from Apache Software Foundation. Attackers are actively exploiting it in the wild (listed by CISA on February 10, 2022). The chance it is exploited in the next 30 days is estimated at 98.9% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)98.9%top 0.1% of all CVEs

Exploited in the wildYesCISA KEV since Feb 10, 2022

Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Aug 10, 2022.

Official description

The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.apache.struts:struts2-struts1-plugin	no fix listed	GHSA-29rm-6752-gvwv

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Struts	2.1.x series2.3.x series

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html x_refsource_CONFIRM
99484 vdb-entry, x_refsource_BID
42324 exploit, x_refsource_EXPLOIT-DB
http://struts.apache.org/docs/s2-048.html x_refsource_CONFIRM
1038838 vdb-entry, x_refsource_SECTRACK
44643 exploit, x_refsource_EXPLOIT-DB
https://security.netapp.com/advisory/ntap-20180706-0002/ x_refsource_CONFIRM
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9791 government-resource