Lucene search

[email protected]CVE-2017-15707

HistoryDec 01, 2017 - 4:29 p.m.

CVE-2017-15707

2017-12-0116:29:00

CWE-20

[email protected]

web.nvd.nist.gov

cve-2017-15707

apache struts

rest plugin

json-lib

dos attack

nvd

6.2 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.3 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

61.1%

JSON

In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.

CPENameOperatorVersion
apache:strutsapache strutsle2.5.14
netapp:oncommand_balancenetapp oncommand balanceeq-
oracle:weblogic_serveroracle weblogic servereq12.2.1.2
oracle:jd_edwards_enterpriseone_toolsoracle jd edwards enterpriseone toolseq9.2
oracle:retail_xstore_point_of_serviceoracle retail xstore point of serviceeq7.1.6
oracle:retail_xstore_point_of_serviceoracle retail xstore point of serviceeq7.0.6
oracle:retail_xstore_point_of_serviceoracle retail xstore point of serviceeq6.5.11
oracle:retail_xstore_point_of_serviceoracle retail xstore point of serviceeq15.0.1
oracle:financial_services_market_risk_measurement_and_managementoracle financial services market risk measurement and managementeq8.0.5
oracle:webcenter_portaloracle webcenter portaleq12.2.1.3.0

CPE	Name	Operator	Version
apache:struts	apache struts	le	2.5.14
netapp:oncommand_balance	netapp oncommand balance	eq	-
oracle:weblogic_server	oracle weblogic server	eq	12.2.1.2
oracle:jd_edwards_enterpriseone_tools	oracle jd edwards enterpriseone tools	eq	9.2
oracle:retail_xstore_point_of_service	oracle retail xstore point of service	eq	7.1.6
oracle:retail_xstore_point_of_service	oracle retail xstore point of service	eq	7.0.6
oracle:retail_xstore_point_of_service	oracle retail xstore point of service	eq	6.5.11
oracle:retail_xstore_point_of_service	oracle retail xstore point of service	eq	15.0.1
oracle:financial_services_market_risk_measurement_and_management	oracle financial services market risk measurement and management	eq	8.0.5
oracle:webcenter_portal	oracle webcenter portal	eq	12.2.1.3.0