CVE-2017-7672

If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12.

• CWE-20

• http://struts.apache.org/docs/s2-047.htmlMitigation, Vendor Advisory
• http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
• http://www.securityfocus.com/bid/99563Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039114
• https://lists.apache.org/thread.html/3795c4dd46d9ec75f4a6eb9eca11c11edd3e796c6c1fd7b17b5dc50d%40%3Cannouncements.struts.apache.org%3E
• https://security.netapp.com/advisory/ntap-20180706-0002/
• http://struts.apache.org/docs/s2-047.htmlMitigation, Vendor Advisory
• http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
• http://www.securityfocus.com/bid/99563Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039114
• https://lists.apache.org/thread.html/3795c4dd46d9ec75f4a6eb9eca11c11edd3e796c6c1fd7b17b5dc50d%40%3Cannouncements.struts.apache.org%3E
• https://security.netapp.com/advisory/ntap-20180706-0002/

Published

Jul 13, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-7666Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Reques…
• CVE-2017-7667Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establ…
• CVE-2017-7668The HTTP strict parsing changes added in Apache httpd 2.2.32…7.5
• CVE-2017-7669In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the …
• CVE-2017-7670The Traffic Router component of the incubating Apache Traffi…
• CVE-2017-7671There is a DOS attack vulnerability in Apache Traffic Server…
• CVE-2017-7673Apache OpenMeetings 1.0.0 uses not very strong cryptographic…
• CVE-2017-7674The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.…
• CVE-2017-7675The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0…
• CVE-2017-7676Policy resource matcher in Apache Ranger before 0.7.1 ignore…
• CVE-2017-7677In environments that use external location for hive tables, …
• CVE-2017-7678In Apache Spark before 2.2.0, it is possible for an attacker…