{"schemaVersion":3,"id":"CVE-2017-9805","aliases":["GHSA-gg9m-fj3v-r58c"],"status":"published","duplicateOf":null,"title":"Apache Struts Deserialization of Untrusted Data Vulnerability","description":"The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.","dates":{"published":"2017-09-15T19:00:00.000Z","modified":"2025-10-21T23:55:34.589Z","reserved":null,"kevAdded":["2021-11-03T00:00:00.000Z"],"kevDue":["2022-05-03T00:00:00.000Z"]},"cvss":{"headline":{"score":8.1,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.8,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false},{"version":"3.0","versionLabel":"v3.0","source":"OSV · Maven","score":8.1,"severity":"high","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","exploitability":5.6,"impact":9.8,"computed":true}]},"epss":{"probability":0.99396,"percentile":0.99942,"severity":"critical","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.99396},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99396,"percentile":0.99942}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99396,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99396,"percentile":0.99942}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2022-05-03T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Apache Struts Deserialization of Untrusted Data Vulnerability","description":"Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2017-9805","label":"nvd.nist.gov/vuln/detail/CVE-2017-9805"}],"vendor":"Apache","product":"Struts","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2022-05-03T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Apache Struts Deserialization of Untrusted Data Vulnerability","description":"Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2017-9805","label":"nvd.nist.gov/vuln/detail/CVE-2017-9805"}],"vendor":"Apache","product":"Struts","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"42627","name":"Apache Struts 2.5 < 2.5.12 - REST Plugin XStream Remote Code Execution","source":"exploit-database","url":"https://www.exploit-db.com/exploits/42627","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"remote","platforms":["linux"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"remote","platform":"linux","file":"exploits/linux/remote/42627.py","codes":["CVE-2017-9805"]},"metasploit":null},{"id":"MSF_EXPLOIT_MULTI_HTTP_STRUTS2_REST_XSTREAM","name":"Apache Struts 2 REST Plugin XStream RCE","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/multi/http/struts2_rest_xstream.rb","maturity":"weaponized","reliabilityScore":1,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/multi/http/struts2_rest_xstream","rank":"600","rankName":"excellent","postAuth":false,"check":true,"stability":["unknown-stability"],"sideEffects":["unknown-side-effects"],"reliability":["unknown-reliability"]}}],"exploitCount":2,"weaknesses":[{"id":"CWE-502","name":"Deserialization of Untrusted Data","description":"The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/502.html"}],"affected":[{"vendor":"apache software foundation","product":"apache struts","name":"Apache Struts","label":"apache struts","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"Apache Struts before 2.3.34 and 2.5.x before 2.5.13","noFixRecorded":false,"fixedIn":null}],"versionsText":"Apache Struts before 2.3.34 and 2.5.x before 2.5.13","eol":null,"hubHref":"/vendor/apache_software_foundation/apache_struts"},{"vendor":"apache","product":"struts","name":"struts","label":"struts","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.1.2, < 2.3.34","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.5.0, < 2.5.13","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.1.2, < 2.3.34 | ≥ 2.5.0, < 2.5.13","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"apache-struts","label":"Apache Struts","category":"framework"}},"hubHref":"/vendor/apache/struts"},{"vendor":"cisco","product":"digital_media_manager","name":"digital media manager","label":"digital_media_manager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/cisco/digital_media_manager"},{"vendor":"cisco","product":"hosted_collaboration_solution","name":"hosted collaboration solution","label":"hosted_collaboration_solution","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"10.5\\(1\\)","noFixRecorded":false,"fixedIn":null},{"text":"11.0\\(1\\)","noFixRecorded":false,"fixedIn":null},{"text":"11.5\\(1\\)","noFixRecorded":false,"fixedIn":null},{"text":"11.6\\(1\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"10.5\\(1\\) | 11.0\\(1\\) | 11.5\\(1\\) | 11.6\\(1\\)","eol":null,"hubHref":"/vendor/cisco/hosted_collaboration_solution"},{"vendor":"cisco","product":"media_experience_engine","name":"media experience engine","label":"media_experience_engine","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"3.5","noFixRecorded":false,"fixedIn":null},{"text":"3.5.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"3.5 | 3.5.2","eol":null,"hubHref":"/vendor/cisco/media_experience_engine"},{"vendor":"cisco","product":"network_performance_analysis","name":"network performance analysis","label":"network_performance_analysis","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/cisco/network_performance_analysis"},{"vendor":"cisco","product":"video_distribution_suite_for_internet_streaming","name":"video distribution suite for internet streaming","label":"video_distribution_suite_for_internet_streaming","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/cisco/video_distribution_suite_for_internet_streaming"},{"vendor":"org.apache.struts","product":"struts2-rest-plugin","name":"org.apache.struts:struts2-rest-plugin","label":"struts2-rest-plugin","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.struts/struts2-rest-plugin","purlType":"maven","versions":[{"text":"≥ 2.1.1, < 2.3.34","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.5.0, < 2.5.13","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.1.1, < 2.3.34 | ≥ 2.5.0, < 2.5.13","eol":null,"hubHref":null},{"vendor":"netapp","product":"oncommand_balance","name":"oncommand balance","label":"oncommand_balance","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/netapp/oncommand_balance"}],"affectedCount":9,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html","label":"www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html","hostname":"www.oracle.com","tags":["X Refsource CONFIRM","Patch","Third Party Advisory","WEB"]},{"url":"https://struts.apache.org/docs/s2-052.html","label":"struts.apache.org/docs/s2-052.html","hostname":"struts.apache.org","tags":["X Refsource CONFIRM","Mitigation","Vendor Advisory","WEB"]},{"url":"http://www.securitytracker.com/id/1039263","label":"www.securitytracker.com/id/1039263","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory","WEB"]},{"url":"http://www.securityfocus.com/bid/100609","label":"www.securityfocus.com/bid/100609","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Third Party Advisory","WEB"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2","label":"tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2","hostname":"tools.cisco.com","tags":["Vendor Advisory","X Refsource CISCO","Third Party Advisory","WEB"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1488482","label":"bugzilla.redhat.com/show_bug.cgi?id=1488482","hostname":"bugzilla.redhat.com","tags":["X Refsource CONFIRM","Issue Tracking","Third Party Advisory","VDB Entry","WEB"]},{"url":"https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax","label":"blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax","hostname":"blogs.apache.org","tags":["X Refsource CONFIRM","Vendor Advisory","WEB"]},{"url":"https://www.exploit-db.com/exploits/42627/","label":"www.exploit-db.com/exploits/42627/","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"https://lgtm.com/blog/apache_struts_CVE-2017-9805","label":"lgtm.com/blog/apache_struts_CVE-2017-9805","hostname":"lgtm.com","tags":["X Refsource MISC","Broken Link","WEB"]},{"url":"https://cwiki.apache.org/confluence/display/WW/S2-052","label":"cwiki.apache.org/confluence/display/WW/S2-052","hostname":"cwiki.apache.org","tags":["X Refsource CONFIRM","Mitigation","Vendor Advisory","WEB"]},{"url":"https://security.netapp.com/advisory/ntap-20170907-0001/","label":"security.netapp.com/advisory/ntap-20170907-0001/","hostname":"security.netapp.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/112992","label":"www.kb.cert.org/vuls/id/112992","hostname":"www.kb.cert.org","tags":["Third Party Advisory","X Refsource CERT VN","US Government Resource","WEB"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9805","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9805","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource","WEB"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9805","label":"nvd.nist.gov/vuln/detail/CVE-2017-9805","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/apache/struts/commit/19494718865f2fb7da5ea363de3822f87fbda26","label":"github.com/apache/struts/commit/19494718865f2fb7da5ea363de3822f87fbda26","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/struts/commit/6dd6e5cfb7b5e020abffe7e8091bd63fe97c10a","label":"github.com/apache/struts/commit/6dd6e5cfb7b5e020abffe7e8091bd63fe97c10a","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/struts","label":"github.com/apache/struts","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://security.netapp.com/advisory/ntap-20170907-0001","label":"security.netapp.com/advisory/ntap-20170907-0001","hostname":"security.netapp.com","tags":["WEB"]},{"url":"https://web.archive.org/web/20170909031344/http://www.securityfocus.com/bid/100609","label":"web.archive.org/web/20170909031344/http://www.securityfocus.com/bid/100609","hostname":"web.archive.org","tags":["WEB"]},{"url":"https://web.archive.org/web/20170922053119/http://www.securitytracker.com/id/1039263","label":"web.archive.org/web/20170922053119/http://www.securitytracker.com/id/1039263","hostname":"web.archive.org","tags":["WEB"]},{"url":"https://www.exploit-db.com/exploits/42627","label":"www.exploit-db.com/exploits/42627","hostname":"www.exploit-db.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2017-09-15T19:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2021-11-03T00:00:00.000Z","label":"Added to CISA KEV","detail":"Apache Struts Deserialization of Untrusted Data Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-05-03T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:55:34.589Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T02:54:22.656Z","stale":false,"partial":false}}