CVE-2017-9805

Fixed upstream ExploitedEPSS 99%CVSS 8.1

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

Published 2017-09-15 · In CISA KEV since 2021-11-03 · CVE record · OSV

Products: Apache Software Foundation Apache Struts

Fixed upstream