CVE-2017-9805

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads...

CVE-2017-9805

CVE-2017-9805 affects the Apache Struts 2 REST plugin. The REST plugin uses an XStreamHandler with an XStream instance to deserialize XML without any type filtering, enabling remote code execution when processing crafted XML payloads. Affected versions are Struts 2.1.1–2.3.x before 2.3.34 and 2.5...

CVE-2017-9805

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of September 11, 2017

In last week’s blog, I mentioned the Apache Struts vulnerability, which is still making headlines as estimates show that as many as 65 percent of Fortune 500 companies use it in some form. In addition, Equifax claims it has played a role in their breach affecting more than 143 million Americans. ...

This Week in Security News

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back...

The vulnerability of the Jakarta Multipart parser on the Apache Struts software platform allows a hacker to execute arbitrary code.

The vulnerability of the Jakarta Multipart parser on the Apache Struts software platform arises from insufficient checks of the values of Content-Type, Content-Disposition, and Content-Length headers. This allows attackers to execute commands on the target system...

The vulnerability of the Freemaker package from the Apache Struts software platform allows a perpetrator to execute arbitrary code.

The vulnerability of the Freemaker package from the Apache Struts software platform exists due to incorrect processing of expressions written in the Object Graph Navigation Language OGNL. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

CVE-2017-9805: Deserialization of Untrusted Data

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads...

CVE-2017-9805

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads. Recent assessments: Assessed...

The vulnerability of the REST plugin of the Apache Struts software framework, which allows a hacker to execute arbitrary code.

The vulnerability of the REST plugin for the Apache Struts software platform exists due to the lack of filtering during deserialization of XML payloads. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

The vulnerability of the Struts 1 plugin for the Apache Struts software platform allows attackers to execute arbitrary code.

The vulnerability of the Struts 1 plugin for the Apache Struts software framework exists due to insufficient validation of data entered by users, which is part of the message. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

Equifax Hackers Stole 200k Credit Card Accounts in One Fell Swoop

Visa and MasterCard are sending confidential alerts to financial institutions across the United States this week, warning them about more than 200,000 credit cards that were stolen in the epic data breach announced last week at big-three credit bureau Equifax. At first glance, the private notices...

Lessons Learned from the Equifax Disaster

143 million U.S. consumers, Equifax.com users who may have been affected by the the worst data breach in history are receiving all sorts of advice including a free TrustedID product license from Equifax. But despite numerous public reports about the incident, there are still many important...

Equifax Suffered Data Breach After It Failed to Patch Old Apache Struts Flaw

The massive Equifax data breach that exposed highly sensitive data of as many as 143 million people was caused by exploiting a flaw in Apache Struts framework, which Apache patched over two months earlier of the security incident, Equifax has confirmed. Credit rating agency Equifax is yet another...

Equifax Hack Blamed on a Flaw in Apache Struts Framework

By Carolina A flaw in Apache Struts framework caused Exposure of Personal This is a post from HackRead.com Read the original post: Equifax Hack Blamed on a Flaw in Apache Struts Framework...

Apache Struts 2 Flaws Affect Multiple Cisco Products

After Equifax massive data breach that was believed to be caused due to a vulnerability in Apache Struts, Cisco has initiated an investigation into its products that incorporate a version of the popular Apache Struts2 web application framework. Apache Struts is a free, open-source MVC framework f...

Apache Foundation Refutes Involvement in Equifax Breach

A group of developers behind Apache Struts, believed by some to be the culprit behind last week’s Equifax breach, took umbrage with those claims over the weekend. René Gielen, vice president of the Apache Struts Project Management Committee PMC at the Apache Software Foundation, wrote Saturday th...

Apache Struts Security Update (S2-050)

Apache Struts is prone to a regular expression Denial of Service DoS vulnerability when using URLValidator. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Apache Struts Security Update (S2-053) - Active Check

Apache Struts is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cisco Releases Security Advisories

Cisco has released advisories describing Apache Struts 2 vulnerabilities potentially affecting multiple products. A remote attacker could exploit one of these vulnerabilities to take control of an affected system. US-CERT encourages users and administrators to review the Cisco Security Advisories...