CVE-2017-9805

Name: CVE-2017-9805
Creator: NVD / NIST
Published: 2017-09-15T19:29:00.237+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.1/10Actively ExploitedEPSS 99.46%

Last modified Jun 17, 2026

CVE-2017-9805 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.. CISA has confirmed active exploitation in the wild. EPSS estimates a 99.46% chance of exploitation in the next 30 days.

Description

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

Metrics

CVSS 3.1

8.1/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

99.46%

99.9th percentile

Probability of exploitation in the next 30 days. Learn more

Exploitation Status

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by May 3, 2022.

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Apache	Struts	>= 2.1.2, < 2.3.34
Apache	Struts	>= 2.5.0, < 2.5.13
Cisco	Digital Media Manager	All versions
Cisco	Hosted Collaboration Solution	10.5\(1\)
Cisco	Hosted Collaboration Solution	11.0\(1\)
Cisco	Hosted Collaboration Solution	11.5\(1\)
Cisco	Hosted Collaboration Solution	11.6\(1\)
Cisco	Media Experience Engine	3.5
Cisco	Media Experience Engine	3.5.2
Cisco	Network Performance Analysis	All versions
Cisco	Video Distribution Suite For Internet Streaming	All versions
Netapp	Oncommand Balance	All versions

References

http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.htmlPatch, Third Party Advisory
http://www.securityfocus.com/bid/100609Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039263Broken Link, Third Party Advisory, VDB Entry
https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifaxVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1488482Issue Tracking, Third Party Advisory, VDB Entry
https://cwiki.apache.org/confluence/display/WW/S2-052Mitigation, Vendor Advisory
https://lgtm.com/blog/apache_struts_CVE-2017-9805Broken Link
https://security.netapp.com/advisory/ntap-20170907-0001/Third Party Advisory
https://struts.apache.org/docs/s2-052.htmlMitigation, Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2Third Party Advisory
https://www.exploit-db.com/exploits/42627/Exploit, Third Party Advisory, VDB Entry
https://www.kb.cert.org/vuls/id/112992Third Party Advisory, US Government Resource
http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.htmlPatch, Third Party Advisory
http://www.securityfocus.com/bid/100609Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039263Broken Link, Third Party Advisory, VDB Entry
https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifaxVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1488482Issue Tracking, Third Party Advisory, VDB Entry
https://cwiki.apache.org/confluence/display/WW/S2-052Mitigation, Vendor Advisory
https://lgtm.com/blog/apache_struts_CVE-2017-9805Broken Link
https://security.netapp.com/advisory/ntap-20170907-0001/Third Party Advisory
https://struts.apache.org/docs/s2-052.htmlMitigation, Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2Third Party Advisory
https://www.exploit-db.com/exploits/42627/Exploit, Third Party Advisory, VDB Entry
https://www.kb.cert.org/vuls/id/112992Third Party Advisory, US Government Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9805US Government Resource

Timeline

Published: Sep 15, 2017
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2017-9805?

How severe is CVE-2017-9805?

CVE-2017-9805 has a CVSS score of 8.1/10 (HIGH severity). The EPSS model estimates a 99.46% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

How do I fix CVE-2017-9805?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-9805?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST