Lucene search

ApacheCVE-2017-9804

HistorySep 20, 2017 - 5:29 p.m.

CVE-2017-9804

2017-09-2017:29:00

CWE-20

apache

web.nvd.nist.gov

apache

struts

2.3.7

2.3.33

2.5

2.5.12

cve-2017-9804

nvd

security

vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.4

Confidence

High

EPSS

0.039

Percentile

92.0%

JSON

In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.

Affected configurations

Nvd

Vulners

Node

apachestrutsMatch2.3.7

apachestrutsMatch2.3.8

apachestrutsMatch2.3.9

apachestrutsMatch2.3.10

apachestrutsMatch2.3.11

apachestrutsMatch2.3.12

apachestrutsMatch2.3.13

apachestrutsMatch2.3.14

apachestrutsMatch2.3.14.1

apachestrutsMatch2.3.14.2

apachestrutsMatch2.3.14.3

apachestrutsMatch2.3.15

apachestrutsMatch2.3.15.1

apachestrutsMatch2.3.15.2

apachestrutsMatch2.3.15.3

apachestrutsMatch2.3.16

apachestrutsMatch2.3.16.1

apachestrutsMatch2.3.16.2

apachestrutsMatch2.3.16.3

apachestrutsMatch2.3.17

apachestrutsMatch2.3.19

apachestrutsMatch2.3.20

apachestrutsMatch2.3.20.1

apachestrutsMatch2.3.20.2

apachestrutsMatch2.3.21

apachestrutsMatch2.3.22

apachestrutsMatch2.3.23

apachestrutsMatch2.3.24.2

apachestrutsMatch2.3.24.3

apachestrutsMatch2.3.25

apachestrutsMatch2.3.26

apachestrutsMatch2.3.27

apachestrutsMatch2.3.28

apachestrutsMatch2.3.28.1

apachestrutsMatch2.3.29

apachestrutsMatch2.3.30

apachestrutsMatch2.3.31

apachestrutsMatch2.3.32

apachestrutsMatch2.3.33

apachestrutsMatch2.5

apachestrutsMatch2.5beta1

apachestrutsMatch2.5beta2

apachestrutsMatch2.5beta3

apachestrutsMatch2.5.1

apachestrutsMatch2.5.2

apachestrutsMatch2.5.3

apachestrutsMatch2.5.4

apachestrutsMatch2.5.5

apachestrutsMatch2.5.6

apachestrutsMatch2.5.7

apachestrutsMatch2.5.8

apachestrutsMatch2.5.9

apachestrutsMatch2.5.10

apachestrutsMatch2.5.10.1

apachestrutsMatch2.5.12

VendorProductVersionCPE
apachestruts2.3.7cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:*
apachestruts2.3.8cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:*
apachestruts2.3.9cpe:2.3:a:apache:struts:2.3.9:*:*:*:*:*:*:*
apachestruts2.3.10cpe:2.3:a:apache:struts:2.3.10:*:*:*:*:*:*:*
apachestruts2.3.11cpe:2.3:a:apache:struts:2.3.11:*:*:*:*:*:*:*
apachestruts2.3.12cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:*
apachestruts2.3.13cpe:2.3:a:apache:struts:2.3.13:*:*:*:*:*:*:*
apachestruts2.3.14cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:*
apachestruts2.3.14.1cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:*
apachestruts2.3.14.2cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	struts	2.3.7	cpe:2.3:a:apache:struts:2.3.7:::::::*
apache	struts	2.3.8	cpe:2.3:a:apache:struts:2.3.8:::::::*
apache	struts	2.3.9	cpe:2.3:a:apache:struts:2.3.9:::::::*
apache	struts	2.3.10	cpe:2.3:a:apache:struts:2.3.10:::::::*
apache	struts	2.3.11	cpe:2.3:a:apache:struts:2.3.11:::::::*
apache	struts	2.3.12	cpe:2.3:a:apache:struts:2.3.12:::::::*
apache	struts	2.3.13	cpe:2.3:a:apache:struts:2.3.13:::::::*
apache	struts	2.3.14	cpe:2.3:a:apache:struts:2.3.14:::::::*
apache	struts	2.3.14.1	cpe:2.3:a:apache:struts:2.3.14.1:::::::*
apache	struts	2.3.14.2	cpe:2.3:a:apache:struts:2.3.14.2:::::::*

Rows per page:

1-10 of 551

CNA Affected

[
  {
    "product": "Apache Struts",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "2.3.7 - 2.3.33"
      },
      {
        "status": "affected",
        "version": "2.5 - 2.5.12"
      }
    ]
  }
]