Detections
Analytics

SCA: security update for org.apache.struts:struts2-rest-plugin (GHSA-gg9m-fj3v-r58c)

high Tenable Self-Hosted Container Security Plugin ID 421967

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an
 XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead
 to Remote Code Execution when deserializing XML payloads. (CVE-2017-9805)

See Also

https://github.com/advisories/GHSA-gg9m-fj3v-r58c

Plugin Details

Severity: High

ID: 421967

Version: Revision 1.12

Type: Local

Family: SCA Checks

Published: 3/28/2025

Updated: 5/27/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 8.9

Percentile: 99.7

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2017-9805

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/16/2018

Vulnerability Publication Date: 7/20/2017

CISA Known Exploited Vulnerability Due Dates: 5/3/2022

Exploitable With

Core Impact

Metasploit (Apache Struts 2 REST Plugin XStream RCE)

Elliot (Apache Struts REST Plugin XStream RCE)

Reference Information

CVE: CVE-2017-9805

BID: 100609

cwe: CWE-502