9.8Crítica
KEV
CVE-2017-9791Apache Struts 1 Improper Input Validation Vulnerability
Explotación conocida — Apache Struts 1 Improper Input Validation Vulnerability
CISA confirmó el 10.02.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 10.08.2022.
Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2017-9791
Descripción
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
Debilidad (CWE):
CWE-20
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Apache Software Foundation | Apache Struts | 2.1.x series, 2.3.x series | |
| apache | struts | 2.3.1 |
Referencias y parches
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html PatchThird Party Advisory
- 99484 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 42324 exploitThird Party AdvisoryVDB Entry
- http://struts.apache.org/docs/s2-048.html MitigationVendor Advisory
- 1038838 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 44643 exploitThird Party AdvisoryVDB Entry
- https://security.netapp.com/advisory/ntap-20180706-0002/ Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9791 US Government Resource
Coincidencias CPE (NVD) (33)
cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.20.3:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.31:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.32:*:*:*:*:*:*:*