REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2017-9805US | high8.1OT kritisch | KEV | ||
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type f… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.htmlWEB
- http://www.securityfocus.com/bid/100609WEB
- http://www.securitytracker.com/id/1039263WEB
- https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifaxWEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1488482WEB
- https://cwiki.apache.org/confluence/display/WW/S2-052WEB
- https://github.com/apache/strutsPACKAGE
- https://github.com/apache/struts/commit/19494718865f2fb7da5ea363de3822f87fbda26WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan