Lucene search
PRIOn knowledge basePRION:CVE-2017-9804HistorySep 20, 2017 - 5:29 p.m.
Code injection
2017-09-2017:29:00
PRIOn knowledge base
www.prio-n.com
7
In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.
References
www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt
www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
www.securityfocus.com/bid/100612
www.securitytracker.com/id/1039261
security.netapp.com/advisory/ntap-20180629-0001/
struts.apache.org/docs/s2-050.html
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2
Related
cve
cve
CVE-2017-9804
2017-09-20 17:29:00
CVE-2017-7672
2017-07-13 15:29:00
ubuntucve
ubuntucve
CVE-2017-9804
2017-09-20 00:00:00
CVE-2017-7672
2017-07-13 00:00:00
nvd
nvd
CVE-2017-9804
2017-09-20 17:29:00
CVE-2017-7672
2017-07-13 15:29:00
redhatcve
redhatcve
CVE-2017-9804
2017-09-05 14:19:09
CVE-2017-7672
2017-08-11 13:48:28
github
github
Apache Struts allows entering a custom URL in a form field if built-in URLValidator is used
2018-10-16 19:37:33
Apache Struts Improper Input Validation vulnerability
2018-10-16 19:36:43
veracode
veracode
Regular Expression Denial Of Service (ReDoS)
2017-09-05 21:13:06
Denial Of Service (DoS)
2017-07-14 05:43:57
cvelist
cvelist
CVE-2017-9804
2017-09-05 00:00:00
CVE-2017-7672
2017-07-13 00:00:00
osv
osv
CVE-2017-9804
2017-09-20 17:29:00
Apache Struts allows entering a custom URL in a form field if built-in URLValidator is used
2018-10-16 19:37:33
CVE-2017-7672
2017-07-13 15:29:00
f5
f5
K12542008 : Apache Struts vulnerabilities CVE-2017-9793 and CVE-2017-9804
2017-09-08 00:00:00
K00503780 : Apache Struts 2 vulnerability CVE-2017-7672
2017-08-03 00:00:00
openvas
openvas
Apache Struts URLValidator DoS Vulnerability (S2-047) - Linux
2017-07-18 00:00:00
Apache Struts Security Update (S2-050)
2017-09-11 00:00:00
Apache Struts Security Update (S2-047)
2017-07-18 00:00:00
prion
prion
Code injection
2017-07-13 15:29:00
threatpost
threatpost
Oracle Patches Apache Struts, Reminds Users to Update Equifax Bug
2017-09-26 14:28:26
nessus
nessus
Oracle WebLogic Server Multiple Vulnerabilities
2017-10-04 00:00:00
Apache Struts 2.5.x < 2.5.12 Multiple DoS (S2-047) (S2-049)
2017-07-14 00:00:00
ibm
ibm
cisco
cisco
fortinet
fortinet
Apache Struts RCE Vulnerability
2017-09-29 00:00:00
thn
thn
Apache Struts 2 Flaws Affect Multiple Cisco Products
2017-09-11 23:50:00