CVE-2017-9805
Yüksek CISA KEV: Aktif İstismarTeknik Veri (Otomatik)
- CVSS Skoru
- 8.1
- EPSS
- 99.4%
- CWE
- CWE-502
- KEV Durumu
- Evet
Yayım tarihi: 15 Eylül 2017 · CISA KEV son iyileştirme tarihi: 3 Mayıs 2022
Etkilenen: apache struts
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
Referanslar
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
- http://www.securityfocus.com/bid/100609
- http://www.securitytracker.com/id/1039263
- https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax
- https://bugzilla.redhat.com/show_bug.cgi?id=1488482
- https://cwiki.apache.org/confluence/display/WW/S2-052
Bu CVE için henüz editoryal inceleme yapılmadı. Sadece otomatik teknik veri gösteriliyor.