Read the docs
TI-2017-07171 Aliases CVE-2017-9791GHSA-29rm-6752-gvwv

Improper input validation in Apache Struts

Priority CRITICAL 100Exploited in the wildCWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

Why it matters now

Exploitation Active In CISA KEV since 2022-02-10CISA due date 2022-08-10
EPSS 0.98908 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Struts2.1.x series; 2.3.x series—No fix listedCNA
—org.apache.struts:struts2-struts1-plugin (Maven)up to 2.3.37—No fix listedGHSA-29rm-6752-gvwv
  • Apache Struts VendorApache Affected 2.1.x series; 2.3.x series Fixed in — No fix listed CNA
  • org.apache.struts:struts2-struts1-plugin (Maven) Vendor— Affected up to 2.3.37 Fixed in — No fix listed GHSA-29rm-6752-gvwv

CPE configurations NVD · 33

CPEVersionsRoleVendor
cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:*2.3.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*2.3.1.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*2.3.1.2VulnerableApache
cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*2.3.3VulnerableApache
cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*2.3.4VulnerableApache
cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:*2.3.4.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:*2.3.7VulnerableApache
cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:*2.3.8VulnerableApache
cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:*2.3.12VulnerableApache
cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:*2.3.14VulnerableApache
  • cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:* Versions 2.3.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:* Versions 2.3.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:* Versions 2.3.1.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:* Versions 2.3.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:* Versions 2.3.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:* Versions 2.3.4.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:* Versions 2.3.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:* Versions 2.3.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:* Versions 2.3.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:* Versions 2.3.14 Vulnerable ·Apache
Show 23 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:*2.3.14.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:*2.3.14.2VulnerableApache
cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:*2.3.14.3VulnerableApache
cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:*2.3.15VulnerableApache
cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:*2.3.15.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:*2.3.15.2VulnerableApache
cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:*2.3.15.3VulnerableApache
cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:*2.3.16VulnerableApache
cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:*2.3.16.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:*2.3.16.2VulnerableApache
cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:*2.3.16.3VulnerableApache
cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:*2.3.20VulnerableApache
cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:*2.3.20.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.20.3:*:*:*:*:*:*:*2.3.20.3VulnerableApache
cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:*2.3.24VulnerableApache
cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:*2.3.24.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:*2.3.24.3VulnerableApache
cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:*2.3.28VulnerableApache
cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:*2.3.28.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:*2.3.29VulnerableApache
cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:*2.3.30VulnerableApache
cpe:2.3:a:apache:struts:2.3.31:*:*:*:*:*:*:*2.3.31VulnerableApache
cpe:2.3:a:apache:struts:2.3.32:*:*:*:*:*:*:*2.3.32VulnerableApache
  • cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:* Versions 2.3.14.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:* Versions 2.3.14.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:* Versions 2.3.14.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:* Versions 2.3.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:* Versions 2.3.15.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:* Versions 2.3.15.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:* Versions 2.3.15.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:* Versions 2.3.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:* Versions 2.3.16.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:* Versions 2.3.16.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:* Versions 2.3.16.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:* Versions 2.3.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:* Versions 2.3.20.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.20.3:*:*:*:*:*:*:* Versions 2.3.20.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:* Versions 2.3.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:* Versions 2.3.24.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:* Versions 2.3.24.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:* Versions 2.3.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:* Versions 2.3.28.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:* Versions 2.3.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:* Versions 2.3.30 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.31:*:*:*:*:*:*:* Versions 2.3.31 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.32:*:*:*:*:*:*:* Versions 2.3.32 Vulnerable ·Apache

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat JBoss Fuse Service Works 6

Timeline

  1. 2022-02-10 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2017-9791
  3. 2026-10-03 Alias added: GHSA-29rm-6752-gvwv

References

Exploit 2

Patch 1

Advisory 3

Other 5

  • TI-2020-13278 Expression language injection in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2013-02013 Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL… KEVCVSS 3.1CRITICAL 9.8
  • TI-2012-00357 The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-08433 Improper input validation in Apache Struts KEVCVSS 3.1HIGH 8.1
  • TI-2017-07185 Deserialization of untrusted data in Apache Struts KEVCVSS 3.1HIGH 8.1
See all 98 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences