PT-2017-4346 · Apache+1 · Apache Struts+1
Publicado
2017-09-06
·
Atualizado
2019-08-12
·
CVE-2017-9793
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions:
Apache Struts versions 2.1.x, 2.3.7 through 2.3.33, 2.5 through 2.5.12
Description:
The issue is related to insufficient input validation in the struts2-core library of the Apache Struts platform. It allows a remote attacker to cause a denial of service using specially crafted XML files. The REST Plugin in Apache Struts uses an outdated XStream library, which is vulnerable and can be exploited to perform a denial of service attack using a malicious request with a specially crafted XML payload.
Recommendations:
For Apache Struts versions 2.1.x, update to a version that uses an updated XStream library to prevent exploitation.
For Apache Struts versions 2.3.7 through 2.3.33, update to a version that uses an updated XStream library to prevent exploitation.
For Apache Struts versions 2.5 through 2.5.12, update to a version that uses an updated XStream library to prevent exploitation.
As a temporary workaround, consider restricting access to the REST Plugin until a patch is available.
Correção
DoS
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Apache Struts
Xstream Library