CVE-2017-9805

high

Description

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

References

https://www.kb.cert.org/vuls/id/112992

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2

https://security.netapp.com/advisory/ntap-20170907-0001/

https://bugzilla.redhat.com/show_bug.cgi?id=1488482

http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html

https://www.darkreading.com/threat-intelligence/earth-lamia-exploits-sql-rce-bugs-asia

https://thehackernews.com/2025/05/china-linked-hackers-exploit-sap-and.html

https://www.securityweek.com/chinese-hacking-group-earth-lamia-targets-multiple-industries/

https://www.trendmicro.com/en_us/research/25/e/earth-lamia.html

https://struts.apache.org/docs/s2-052.html

https://cwiki.apache.org/confluence/display/WW/S2-052

https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax

Details

Source: Mitre, NVD

Published: 2017-09-15

Updated: 2025-04-20

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 8.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.9439