Read the docs
TI-2017-07167 Aliases CVE-2017-9787GHSA-8mr5-h28g-36qx

When using a Spring AOP functionality to secure Struts actions it is possible to perform…

Priority MEDIUM 46Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33.

Why it matters now

EPSS 0.10554 95th percentileScored 2026-11-07
Fix Fixed Apache Struts (Apache Software Foundation): 2.3.33org.apache.struts:struts2-core (Maven): 2.3.33, 2.5.12

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Struts2.3 to before 2.3.33; 2.5 to 2.5.10.12.3.33Patch availableCNA
—org.apache.struts:struts2-core (Maven)2.3.7 to before 2.3.332.3.33Patch availableGHSA-8mr5-h28g-36qx
—org.apache.struts:struts2-core (Maven)2.5.0 to before 2.5.122.5.12Patch availableGHSA-8mr5-h28g-36qx
  • Apache Struts VendorApache Affected 2.3 to before 2.3.33; 2.5 to 2.5.10.1 Fixed in 2.3.33 Patch available CNA
  • org.apache.struts:struts2-core (Maven) Vendor— Affected 2.3.7 to before 2.3.33 Fixed in 2.3.33 Patch available GHSA-8mr5-h28g-36qx
  • org.apache.struts:struts2-core (Maven) Vendor— Affected 2.5.0 to before 2.5.12 Fixed in 2.5.12 Patch available GHSA-8mr5-h28g-36qx

CPE configurations NVD · 53

CPEVersionsRoleVendor
cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:*2.3.7VulnerableApache
cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:*2.3.8VulnerableApache
cpe:2.3:a:apache:struts:2.3.9:*:*:*:*:*:*:*2.3.9VulnerableApache
cpe:2.3:a:apache:struts:2.3.10:*:*:*:*:*:*:*2.3.10VulnerableApache
cpe:2.3:a:apache:struts:2.3.11:*:*:*:*:*:*:*2.3.11VulnerableApache
cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:*2.3.12VulnerableApache
cpe:2.3:a:apache:struts:2.3.13:*:*:*:*:*:*:*2.3.13VulnerableApache
cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:*2.3.14VulnerableApache
cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:*2.3.14.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:*2.3.14.2VulnerableApache
  • cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:* Versions 2.3.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:* Versions 2.3.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.9:*:*:*:*:*:*:* Versions 2.3.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.10:*:*:*:*:*:*:* Versions 2.3.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.11:*:*:*:*:*:*:* Versions 2.3.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:* Versions 2.3.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.13:*:*:*:*:*:*:* Versions 2.3.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:* Versions 2.3.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:* Versions 2.3.14.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:* Versions 2.3.14.2 Vulnerable ·Apache
Show 43 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:*2.3.14.3VulnerableApache
cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:*2.3.15VulnerableApache
cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:*2.3.15.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:*2.3.15.2VulnerableApache
cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:*2.3.15.3VulnerableApache
cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:*2.3.16VulnerableApache
cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:*2.3.16.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:*2.3.16.2VulnerableApache
cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:*2.3.16.3VulnerableApache
cpe:2.3:a:apache:struts:2.3.17:*:*:*:*:*:*:*2.3.17VulnerableApache
cpe:2.3:a:apache:struts:2.3.19:*:*:*:*:*:*:*2.3.19VulnerableApache
cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:*2.3.20VulnerableApache
cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:*2.3.20.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.20.2:*:*:*:*:*:*:*2.3.20.2VulnerableApache
cpe:2.3:a:apache:struts:2.3.20.3:*:*:*:*:*:*:*2.3.20.3VulnerableApache
cpe:2.3:a:apache:struts:2.3.21:*:*:*:*:*:*:*2.3.21VulnerableApache
cpe:2.3:a:apache:struts:2.3.22:*:*:*:*:*:*:*2.3.22VulnerableApache
cpe:2.3:a:apache:struts:2.3.23:*:*:*:*:*:*:*2.3.23VulnerableApache
cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:*2.3.24VulnerableApache
cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:*2.3.24.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.24.2:*:*:*:*:*:*:*2.3.24.2VulnerableApache
cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:*2.3.24.3VulnerableApache
cpe:2.3:a:apache:struts:2.3.25:*:*:*:*:*:*:*2.3.25VulnerableApache
cpe:2.3:a:apache:struts:2.3.26:*:*:*:*:*:*:*2.3.26VulnerableApache
cpe:2.3:a:apache:struts:2.3.27:*:*:*:*:*:*:*2.3.27VulnerableApache
cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:*2.3.28VulnerableApache
cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:*2.3.28.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:*2.3.29VulnerableApache
cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:*2.3.30VulnerableApache
cpe:2.3:a:apache:struts:2.3.31:*:*:*:*:*:*:*2.3.31VulnerableApache
cpe:2.3:a:apache:struts:2.3.32:*:*:*:*:*:*:*2.3.32VulnerableApache
cpe:2.3:a:apache:struts:2.5:*:*:*:*:*:*:*2.5VulnerableApache
cpe:2.3:a:apache:struts:2.5.1:*:*:*:*:*:*:*2.5.1VulnerableApache
cpe:2.3:a:apache:struts:2.5.2:*:*:*:*:*:*:*2.5.2VulnerableApache
cpe:2.3:a:apache:struts:2.5.3:*:*:*:*:*:*:*2.5.3VulnerableApache
cpe:2.3:a:apache:struts:2.5.4:*:*:*:*:*:*:*2.5.4VulnerableApache
cpe:2.3:a:apache:struts:2.5.5:*:*:*:*:*:*:*2.5.5VulnerableApache
cpe:2.3:a:apache:struts:2.5.6:*:*:*:*:*:*:*2.5.6VulnerableApache
cpe:2.3:a:apache:struts:2.5.7:*:*:*:*:*:*:*2.5.7VulnerableApache
cpe:2.3:a:apache:struts:2.5.8:*:*:*:*:*:*:*2.5.8VulnerableApache
cpe:2.3:a:apache:struts:2.5.9:*:*:*:*:*:*:*2.5.9VulnerableApache
cpe:2.3:a:apache:struts:2.5.10:*:*:*:*:*:*:*2.5.10VulnerableApache
cpe:2.3:a:apache:struts:2.5.10.1:*:*:*:*:*:*:*2.5.10.1VulnerableApache
  • cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:* Versions 2.3.14.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:* Versions 2.3.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:* Versions 2.3.15.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:* Versions 2.3.15.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:* Versions 2.3.15.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:* Versions 2.3.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:* Versions 2.3.16.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:* Versions 2.3.16.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:* Versions 2.3.16.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.17:*:*:*:*:*:*:* Versions 2.3.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.19:*:*:*:*:*:*:* Versions 2.3.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:* Versions 2.3.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:* Versions 2.3.20.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.20.2:*:*:*:*:*:*:* Versions 2.3.20.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.20.3:*:*:*:*:*:*:* Versions 2.3.20.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.21:*:*:*:*:*:*:* Versions 2.3.21 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.22:*:*:*:*:*:*:* Versions 2.3.22 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.23:*:*:*:*:*:*:* Versions 2.3.23 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:* Versions 2.3.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:* Versions 2.3.24.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.24.2:*:*:*:*:*:*:* Versions 2.3.24.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:* Versions 2.3.24.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.25:*:*:*:*:*:*:* Versions 2.3.25 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.26:*:*:*:*:*:*:* Versions 2.3.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.27:*:*:*:*:*:*:* Versions 2.3.27 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:* Versions 2.3.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:* Versions 2.3.28.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:* Versions 2.3.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:* Versions 2.3.30 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.31:*:*:*:*:*:*:* Versions 2.3.31 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.32:*:*:*:*:*:*:* Versions 2.3.32 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5.1:*:*:*:*:*:*:* Versions 2.5.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5.2:*:*:*:*:*:*:* Versions 2.5.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5.3:*:*:*:*:*:*:* Versions 2.5.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5.4:*:*:*:*:*:*:* Versions 2.5.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5.5:*:*:*:*:*:*:* Versions 2.5.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5.6:*:*:*:*:*:*:* Versions 2.5.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5.7:*:*:*:*:*:*:* Versions 2.5.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5.8:*:*:*:*:*:*:* Versions 2.5.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5.9:*:*:*:*:*:*:* Versions 2.5.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5.10:*:*:*:*:*:*:* Versions 2.5.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5.10.1:*:*:*:*:*:*:* Versions 2.5.10.1 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Struts (Apache Software Foundation) Fixed in 2.3.33
  • Fix · GHSA-8mr5-h28g-36qx org.apache.struts:struts2-core (Maven) Fixed in 2.3.33 Advisory →
  • Fix · GHSA-8mr5-h28g-36qx org.apache.struts:struts2-core (Maven) Fixed in 2.5.12 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 3 products
  • Red Hat Enterprise Linux 5
  • Red Hat JBoss Enterprise Web Server 2
  • Red Hat Satellite 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-9787
  2. 2026-10-03 Alias added: GHSA-8mr5-h28g-36qx

References

Advisory 2

Other 11

  • TI-2020-13278 Expression language injection in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-07171 Improper input validation in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2013-02013 Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL… KEVCVSS 3.1CRITICAL 9.8
  • TI-2012-00357 The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-08433 Improper input validation in Apache Struts KEVCVSS 3.1HIGH 8.1
See all 98 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences