Skip to content

CVE-2017-9804 Apache Struts allows entering a custom URL in a form field if built-in URLValidator is used

HighCVSS 7.5 EPSS 8.2%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.

Affected products

ProductAffected versionsFixed in
org.apache.struts/struts2-core(Maven) >= 2.3.7, < 2.3.34 2.3.34
org.apache.struts/struts2-core(Maven) = 2.3.12 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.14 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.14.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.14.2 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.14.3 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.15 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.15.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.15.2 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.15.3 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.16 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.16.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.16.2 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.16.3 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.20 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.20.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.20.3 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.24 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.24.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.24.3 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.28 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.28.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.29 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.30 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.31 No fix listed
Show 72 more
ProductAffected versionsFixed in
org.apache.struts/struts2-core(Maven) = 2.3.32 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.33 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.7 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.8 No fix listed
org.apache.struts/struts2-core(Maven) >= 2.5.0, < 2.5.13 2.5.13
org.apache.struts/struts2-core(Maven) = 2.5 No fix listed
org.apache.struts/struts2-core(Maven) = 2.5.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.5.10 No fix listed
org.apache.struts/struts2-core(Maven) = 2.5.10.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.5.12 No fix listed
org.apache.struts/struts2-core(Maven) = 2.5.2 No fix listed
org.apache.struts/struts2-core(Maven) = 2.5.5 No fix listed
org.apache.struts/struts2-core(Maven) = 2.5.8 No fix listed
org.apache.struts/struts2-core(Maven) >= 2.3.7, <= 2.3.33 No fix listed
org.apache.struts/struts2-core(Maven) >= 2.5.0, <= 2.5.12 No fix listed
apache struts = 2.3.7 No fix listed
apache struts = 2.3.8 No fix listed
apache struts = 2.3.9 No fix listed
apache struts = 2.3.10 No fix listed
apache struts = 2.3.11 No fix listed
apache struts = 2.3.12 No fix listed
apache struts = 2.3.13 No fix listed
apache struts = 2.3.14 No fix listed
apache struts = 2.3.14.1 No fix listed
apache struts = 2.3.14.2 No fix listed
apache struts = 2.3.14.3 No fix listed
apache struts = 2.3.15 No fix listed
apache struts = 2.3.15.1 No fix listed
apache struts = 2.3.15.2 No fix listed
apache struts = 2.3.15.3 No fix listed
apache struts = 2.3.16 No fix listed
apache struts = 2.3.16.1 No fix listed
apache struts = 2.3.16.2 No fix listed
apache struts = 2.3.16.3 No fix listed
apache struts = 2.3.17 No fix listed
apache struts = 2.3.19 No fix listed
apache struts = 2.3.20 No fix listed
apache struts = 2.3.20.1 No fix listed
apache struts = 2.3.20.2 No fix listed
apache struts = 2.3.21 No fix listed
apache struts = 2.3.22 No fix listed
apache struts = 2.3.23 No fix listed
apache struts = 2.3.24.2 No fix listed
apache struts = 2.3.24.3 No fix listed
apache struts = 2.3.25 No fix listed
apache struts = 2.3.26 No fix listed
apache struts = 2.3.27 No fix listed
apache struts = 2.3.28 No fix listed
apache struts = 2.3.28.1 No fix listed
apache struts = 2.3.29 No fix listed
apache struts = 2.3.30 No fix listed
apache struts = 2.3.31 No fix listed
apache struts = 2.3.32 No fix listed
apache struts = 2.3.33 No fix listed
apache struts = 2.5 No fix listed
apache struts = 2.5-beta1 No fix listed
apache struts = 2.5-beta2 No fix listed
apache struts = 2.5-beta3 No fix listed
apache struts = 2.5.1 No fix listed
apache struts = 2.5.2 No fix listed
apache struts = 2.5.3 No fix listed
apache struts = 2.5.4 No fix listed
apache struts = 2.5.5 No fix listed
apache struts = 2.5.6 No fix listed
apache struts = 2.5.7 No fix listed
apache struts = 2.5.8 No fix listed
apache struts = 2.5.9 No fix listed
apache struts = 2.5.10 No fix listed
apache struts = 2.5.10.1 No fix listed
apache struts = 2.5.12 No fix listed
Apache Struts = 2.3.7 - 2.3.33 No fix listed
Apache Struts = 2.5 - 2.5.12 No fix listed

References