Evil-DB LogoEvil-DB
← All CVEs

CVE-2017-9791

critical · 9.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply updates per vendor instructions.

Added 2022-02-10Remediation due 2022-08-10

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

9.8
CVSS
98.9%
EPSS (exploit prob.)
100th
EPSS percentile
2017-07-10
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-20

Affected products

VendorProductAffected versions
apachestruts2.3.1
apachestruts2.3.1.1
apachestruts2.3.1.2
apachestruts2.3.3
apachestruts2.3.4
apachestruts2.3.4.1
apachestruts2.3.7
apachestruts2.3.8
apachestruts2.3.12
apachestruts2.3.14
apachestruts2.3.14.1
apachestruts2.3.14.2
apachestruts2.3.14.3
apachestruts2.3.15
apachestruts2.3.15.1
apachestruts2.3.15.2
apachestruts2.3.15.3
apachestruts2.3.16
apachestruts2.3.16.1
apachestruts2.3.16.2
apachestruts2.3.16.3
apachestruts2.3.20
apachestruts2.3.20.1
apachestruts2.3.20.3
apachestruts2.3.24
apachestruts2.3.24.1
apachestruts2.3.24.3
apachestruts2.3.28
apachestruts2.3.28.1
apachestruts2.3.29
apachestruts2.3.30
apachestruts2.3.31
apachestruts2.3.32

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2017-9791