CVE-2017-9791
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2017-9791
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-9791.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2017-9791
- Aliases
- Published
- 2017-07-10T16:29:00.277Z
- Modified
- 2025-11-14T05:22:36.495185Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
- References
-
- http://struts.apache.org/docs/s2-048.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9791
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
- http://www.securityfocus.com/bid/99484
- http://www.securitytracker.com/id/1038838
- https://security.netapp.com/advisory/ntap-20180706-0002/
- https://www.exploit-db.com/exploits/42324/
- https://www.exploit-db.com/exploits/44643/
Affected packages
Git / github.com/apache/struts
Affected ranges
- Type
- GIT
- Repo
- https://github.com/apache/struts
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affected