Apache · Struts
CVE-2017-9805
Apache Struts Deserialization of Untrusted Data Vulnerability
What it is
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
CISA: Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
- Added to the CISA list
- November 3, 2021
- Published
- September 15, 2017
- Severity
- High 8.1 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 99.4% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-502
- More details
- NVD · CVE.org · CISA
All references (12)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
- https://struts.apache.org/docs/s2-052.html
- http://www.securitytracker.com/id/1039263
- http://www.securityfocus.com/bid/100609
- https://bugzilla.redhat.com/show_bug.cgi?id=1488482
- https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax
- https://www.exploit-db.com/exploits/42627/
- https://lgtm.com/blog/apache_struts_CVE-2017-9805
- https://cwiki.apache.org/confluence/display/WW/S2-052
- https://security.netapp.com/advisory/ntap-20170907-0001/
- https://www.kb.cert.org/vuls/id/112992
More exploited flaws from Apache
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 8, 2026 | Command Injection | Struts | High 8.1 | 97% |
| Mar 25, 2022 | Improper Input Validation | Struts | Critical 9.8 | >99.9% |
| Nov 3, 2021 | Remote Code Execution | Struts | Critical 9.8 | >99.9% |
| Nov 3, 2021 | Remote Code Execution | Struts | High 8.1 | >99.9% |
| Nov 3, 2021 | Remote Code Execution | Struts | Critical 9.8 | 96% |
| Aug 4, 2026 | Missing Encryption of Sensitive Data | Tomcat | High 7.5 | 99% |
| Apr 16, 2026 | Improper Input Validation | ActiveMQ | High 8.8 | 98% |
| May 1, 2025 | Improper Escaping of Output | HTTP Server | Critical 9.1 | >99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.