Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Advisory: Apache Struts — 20170907 Multiple Vulnerabilities in Apache Struts 2 Affecting Cisco Products: September 2017 Clear all filters
TI-2017-07184 CVE-2017-9804 · GHSA-x5x7-3v85-wpc4

Improper input validation in Apache Struts

Priority MEDIUM 44

In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overl…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.08237 Published 2017-09-20 Fixed in 2.3.34, 2.5.13 CWE-20
TI-2017-07173 CVE-2017-9793 · GHSA-vwxj-6m5m-rrvh

Improper input validation in Apache Struts

Priority MEDIUM 44

The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted X…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.08787 Published 2017-09-20 Fixed in 2.3.34, 2.5.13 CWE-20
TI-2017-07185 CVE-2017-9805 · GHSA-gg9m-fj3v-r58c

Deserialization of untrusted data in Apache Struts

Priority CRITICAL 94KEV

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.99396 Published 2017-09-15 Fixed in 2.3.34, 2.5.13 CWE-502