CVE-2017-9805: Apache Struts Deserialization of Untrusted Data Vulnerability
Vulnerability summary
CVE-2017-9805 is a high (CVSS 8.1) Deserialization of Untrusted Data vulnerability in Apache Struts. It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 99.40% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 15-09-2017PublishedVulnerability first disclosed.
- 03-11-2021Added to CISA KEVApache Struts Deserialization of Untrusted Data Vulnerability
- 03-05-2022CISA remediation dueApply updates per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
CVSS metrics
4 scores · 3 sources · 3 versions- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
99.40%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 99.40% on 18-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 03-11-2021
- Federal due date
- 03-05-2022
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2017-9805
Public exploits
2 foundApache Struts 2.5 < 2.5.12 - REST Plugin XStream Remote Code Execution
Maturity: poc
Apache Struts 2 REST Plugin XStream RCE
exploit/multi/http/struts2_rest_xstream
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Cisco5 products
- digital_media_managerna
- hosted_collaboration_solution10.5\(1\) | 11.0\(1\) | 11.5\(1\) | 11.6\(1\)
- media_experience_engine3.5 | 3.5.2
- network_performance_analysisna
- video_distribution_suite_for_internet_streamingna
Apache1 product
- struts≥ 2.1.2, < 2.3.34 | ≥ 2.5.0, < 2.5.13
Apache software foundation1 product
- apache strutsApache Struts before 2.3.34 and 2.5.x before 2.5.13
Netapp1 product
Org.apache.struts1 product
- struts2-rest-plugin≥ 2.1.1, < 2.3.34 | ≥ 2.5.0, < 2.5.13
5 vendors · 9 products
References
21 links- www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.htmlX Refsource CONFIRMPatchThird Party AdvisoryWEB
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2Vendor AdvisoryX Refsource CISCOThird Party AdvisoryWEB
- bugzilla.redhat.com/show_bug.cgi?id=1488482X Refsource CONFIRMIssue TrackingThird Party AdvisoryVDB EntryWEB
- blogs.apache.org/foundation/entry/apache-struts-statement-on-equifaxX Refsource CONFIRMVendor AdvisoryWEB
Show all 21 references
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9805Government ResourceUS Government ResourceWEB
- github.com/apache/strutsPACKAGE