CVE-2017-9804

2017-09-0500:00:00

apache

www.cve.org

6.6 Medium

AI Score

Confidence

High

0.039 Low

EPSS

Percentile

92.0%

JSON

In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.

CNA Affected

[
  {
    "product": "Apache Struts",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "2.3.7 - 2.3.33"
      },
      {
        "status": "affected",
        "version": "2.5 - 2.5.12"
      }
    ]
  }
]