logo

Database

Lack of data validation In org.apache.struts:struts2-struts1-plugin

Description

Code execution in Apache Struts 1 plugin The Struts 1 plugin used with Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version

Aliases

1. CVE-2017-97912. NVD-2017-97913. OSV-2017-97914. GCVE-2017-9791

References

1. https://github.com/apache/struts/commit/ffe0e20edd9d5386f4410fddd970286a693732432. https://security.netapp.com/advisory/ntap-20180706-00023. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-97914. https://www.exploit-db.com/exploits/423245. https://www.exploit-db.com/exploits/446436. http://struts.apache.org/docs/s2-048.html7. http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html8. http://www.securityfocus.com/bid/994849. http://www.securitytracker.com/id/103883810. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9791.yaml11. https://github.com/IanSmith123/s2-04812. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts2_code_exec_showcase.rb

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.