CVE-2017-9791
Published 2017-07-10 · Updated 2026-06-17 · Source security@apache.org
Summary
CVE-2017-9791 is a critical-severity (CVSS 9.8) vulnerability in Apache Struts 1. CISA added it to the Known Exploited Vulnerabilities catalog on February 10, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by August 10, 2022. CISA does not currently list it as used in ransomware campaigns. Apache has 41 vulnerabilities in the KEV catalog, 8 of them linked to ransomware.
All 41 known-exploited Apache vulnerabilities →Description
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Apache — Struts 1
Name: Apache Struts 1 Improper Input Validation Vulnerability
Date added: 2022-02-10 · Due: 2022-08-10
Required action: Apply updates per vendor instructions.
References
- http://struts.apache.org/docs/s2-048.html
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
- http://www.securityfocus.com/bid/99484
- http://www.securitytracker.com/id/1038838
- https://security.netapp.com/advisory/ntap-20180706-0002/
- https://www.exploit-db.com/exploits/42324/
- https://www.exploit-db.com/exploits/44643/
- http://struts.apache.org/docs/s2-048.html