Read the docs
TI-2017-07184 Aliases CVE-2017-9804GHSA-x5x7-3v85-wpc4

Improper input validation in Apache Struts

Priority MEDIUM 44CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.

Why it matters now

EPSS 0.08237 94th percentileScored 2026-11-07
Fix Fixed org.apache.struts:struts2-core (Maven): 2.3.34, 2.5.13

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Struts2.3.7 - 2.3.33; 2.5 - 2.5.12—No fix listedCNA
—org.apache.struts:struts2-core (Maven)2.3.7 to before 2.3.342.3.34Patch availableGHSA-x5x7-3v85-wpc4
—org.apache.struts:struts2-core (Maven)2.5.0 to before 2.5.132.5.13Patch availableGHSA-x5x7-3v85-wpc4
  • Apache Struts VendorApache Affected 2.3.7 - 2.3.33; 2.5 - 2.5.12 Fixed in — No fix listed CNA
  • org.apache.struts:struts2-core (Maven) Vendor— Affected 2.3.7 to before 2.3.34 Fixed in 2.3.34 Patch available GHSA-x5x7-3v85-wpc4
  • org.apache.struts:struts2-core (Maven) Vendor— Affected 2.5.0 to before 2.5.13 Fixed in 2.5.13 Patch available GHSA-x5x7-3v85-wpc4

CPE configurations NVD · 55

CPEVersionsRoleVendor
cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:*2.3.7VulnerableApache
cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:*2.3.8VulnerableApache
cpe:2.3:a:apache:struts:2.3.9:*:*:*:*:*:*:*2.3.9VulnerableApache
cpe:2.3:a:apache:struts:2.3.10:*:*:*:*:*:*:*2.3.10VulnerableApache
cpe:2.3:a:apache:struts:2.3.11:*:*:*:*:*:*:*2.3.11VulnerableApache
cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:*2.3.12VulnerableApache
cpe:2.3:a:apache:struts:2.3.13:*:*:*:*:*:*:*2.3.13VulnerableApache
cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:*2.3.14VulnerableApache
cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:*2.3.14.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:*2.3.14.2VulnerableApache
  • cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:* Versions 2.3.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:* Versions 2.3.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.9:*:*:*:*:*:*:* Versions 2.3.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.10:*:*:*:*:*:*:* Versions 2.3.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.11:*:*:*:*:*:*:* Versions 2.3.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:* Versions 2.3.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.13:*:*:*:*:*:*:* Versions 2.3.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:* Versions 2.3.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:* Versions 2.3.14.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:* Versions 2.3.14.2 Vulnerable ·Apache
Show 45 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:*2.3.14.3VulnerableApache
cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:*2.3.15VulnerableApache
cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:*2.3.15.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:*2.3.15.2VulnerableApache
cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:*2.3.15.3VulnerableApache
cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:*2.3.16VulnerableApache
cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:*2.3.16.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:*2.3.16.2VulnerableApache
cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:*2.3.16.3VulnerableApache
cpe:2.3:a:apache:struts:2.3.17:*:*:*:*:*:*:*2.3.17VulnerableApache
cpe:2.3:a:apache:struts:2.3.19:*:*:*:*:*:*:*2.3.19VulnerableApache
cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:*2.3.20VulnerableApache
cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:*2.3.20.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.20.2:*:*:*:*:*:*:*2.3.20.2VulnerableApache
cpe:2.3:a:apache:struts:2.3.21:*:*:*:*:*:*:*2.3.21VulnerableApache
cpe:2.3:a:apache:struts:2.3.22:*:*:*:*:*:*:*2.3.22VulnerableApache
cpe:2.3:a:apache:struts:2.3.23:*:*:*:*:*:*:*2.3.23VulnerableApache
cpe:2.3:a:apache:struts:2.3.24.2:*:*:*:*:*:*:*2.3.24.2VulnerableApache
cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:*2.3.24.3VulnerableApache
cpe:2.3:a:apache:struts:2.3.25:*:*:*:*:*:*:*2.3.25VulnerableApache
cpe:2.3:a:apache:struts:2.3.26:*:*:*:*:*:*:*2.3.26VulnerableApache
cpe:2.3:a:apache:struts:2.3.27:*:*:*:*:*:*:*2.3.27VulnerableApache
cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:*2.3.28VulnerableApache
cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:*2.3.28.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:*2.3.29VulnerableApache
cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:*2.3.30VulnerableApache
cpe:2.3:a:apache:struts:2.3.31:*:*:*:*:*:*:*2.3.31VulnerableApache
cpe:2.3:a:apache:struts:2.3.32:*:*:*:*:*:*:*2.3.32VulnerableApache
cpe:2.3:a:apache:struts:2.3.33:*:*:*:*:*:*:*2.3.33VulnerableApache
cpe:2.3:a:apache:struts:2.5:*:*:*:*:*:*:*2.5VulnerableApache
cpe:2.3:a:apache:struts:2.5:beta1:*:*:*:*:*:*2.5 beta1VulnerableApache
cpe:2.3:a:apache:struts:2.5:beta2:*:*:*:*:*:*2.5 beta2VulnerableApache
cpe:2.3:a:apache:struts:2.5:beta3:*:*:*:*:*:*2.5 beta3VulnerableApache
cpe:2.3:a:apache:struts:2.5.1:*:*:*:*:*:*:*2.5.1VulnerableApache
cpe:2.3:a:apache:struts:2.5.2:*:*:*:*:*:*:*2.5.2VulnerableApache
cpe:2.3:a:apache:struts:2.5.3:*:*:*:*:*:*:*2.5.3VulnerableApache
cpe:2.3:a:apache:struts:2.5.4:*:*:*:*:*:*:*2.5.4VulnerableApache
cpe:2.3:a:apache:struts:2.5.5:*:*:*:*:*:*:*2.5.5VulnerableApache
cpe:2.3:a:apache:struts:2.5.6:*:*:*:*:*:*:*2.5.6VulnerableApache
cpe:2.3:a:apache:struts:2.5.7:*:*:*:*:*:*:*2.5.7VulnerableApache
cpe:2.3:a:apache:struts:2.5.8:*:*:*:*:*:*:*2.5.8VulnerableApache
cpe:2.3:a:apache:struts:2.5.9:*:*:*:*:*:*:*2.5.9VulnerableApache
cpe:2.3:a:apache:struts:2.5.10:*:*:*:*:*:*:*2.5.10VulnerableApache
cpe:2.3:a:apache:struts:2.5.10.1:*:*:*:*:*:*:*2.5.10.1VulnerableApache
cpe:2.3:a:apache:struts:2.5.12:*:*:*:*:*:*:*2.5.12VulnerableApache
  • cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:* Versions 2.3.14.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:* Versions 2.3.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:* Versions 2.3.15.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:* Versions 2.3.15.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:* Versions 2.3.15.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:* Versions 2.3.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:* Versions 2.3.16.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:* Versions 2.3.16.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:* Versions 2.3.16.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.17:*:*:*:*:*:*:* Versions 2.3.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.19:*:*:*:*:*:*:* Versions 2.3.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:* Versions 2.3.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:* Versions 2.3.20.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.20.2:*:*:*:*:*:*:* Versions 2.3.20.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.21:*:*:*:*:*:*:* Versions 2.3.21 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.22:*:*:*:*:*:*:* Versions 2.3.22 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.23:*:*:*:*:*:*:* Versions 2.3.23 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.24.2:*:*:*:*:*:*:* Versions 2.3.24.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:* Versions 2.3.24.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.25:*:*:*:*:*:*:* Versions 2.3.25 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.26:*:*:*:*:*:*:* Versions 2.3.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.27:*:*:*:*:*:*:* Versions 2.3.27 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:* Versions 2.3.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:* Versions 2.3.28.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:* Versions 2.3.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:* Versions 2.3.30 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.31:*:*:*:*:*:*:* Versions 2.3.31 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.32:*:*:*:*:*:*:* Versions 2.3.32 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.33:*:*:*:*:*:*:* Versions 2.3.33 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5:beta1:*:*:*:*:*:* Versions 2.5 beta1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5:beta2:*:*:*:*:*:* Versions 2.5 beta2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5:beta3:*:*:*:*:*:* Versions 2.5 beta3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5.1:*:*:*:*:*:*:* Versions 2.5.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5.2:*:*:*:*:*:*:* Versions 2.5.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5.3:*:*:*:*:*:*:* Versions 2.5.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5.4:*:*:*:*:*:*:* Versions 2.5.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5.5:*:*:*:*:*:*:* Versions 2.5.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5.6:*:*:*:*:*:*:* Versions 2.5.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5.7:*:*:*:*:*:*:* Versions 2.5.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5.8:*:*:*:*:*:*:* Versions 2.5.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5.9:*:*:*:*:*:*:* Versions 2.5.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5.10:*:*:*:*:*:*:* Versions 2.5.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5.10.1:*:*:*:*:*:*:* Versions 2.5.10.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.5.12:*:*:*:*:*:*:* Versions 2.5.12 Vulnerable ·Apache

Remediation

  • Fix · GHSA-x5x7-3v85-wpc4 org.apache.struts:struts2-core (Maven) Fixed in 2.3.34 Advisory →
  • Fix · GHSA-x5x7-3v85-wpc4 org.apache.struts:struts2-core (Maven) Fixed in 2.5.13 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache Struts — 20170907 Multiple Vulnerabilities in Apache Struts 2 Affecting Cisco Products: September 2017

    3 records Highest priority Priority CRITICAL 1 CRITICAL, 2 MEDIUM

    Other records, highest priority first

    • TI-2017-07185 Deserialization of untrusted data in Apache StrutsPriority CRITICAL 94
    • TI-2017-07173 Improper input validation in Apache StrutsPriority MEDIUM 44
    Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 5 products
  • Red Hat Enterprise Linux 5
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Fuse Service Works 6
  • Red Hat JBoss Operations Network 3
  • Red Hat Satellite 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-9804
  2. 2026-10-03 Alias added: GHSA-x5x7-3v85-wpc4

References

Patch 2

Advisory 3

Other 6

  • TI-2020-13278 Expression language injection in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-07171 Improper input validation in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2013-02013 Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL… KEVCVSS 3.1CRITICAL 9.8
  • TI-2012-00357 The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-08433 Improper input validation in Apache Struts KEVCVSS 3.1HIGH 8.1
See all 98 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences