Regular Expression Denial Of Service (ReDoS)

🗓️ 05 Sep 2017 21:13:06Reported by Veracode Vulnerability DatabaseType

struts2-core and xwork-core ReDoS vulnerability due to incomplete fix for CVE-2017-767

Reporter	Title	Published	Views	Family All 159
GithubExploit	Exploit for Deserialization of Untrusted Data in Apache Struts	3 Oct 202200:15	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Apache Struts	6 Sep 201708:32	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Apache Struts	4 Dec 201718:23	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Apache Struts	28 Feb 202611:29	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Apache Struts	9 Sep 201701:32	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Apache Struts	16 Mar 202608:01	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Apache Struts	10 Sep 201705:26	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Apache Struts	4 Jan 202618:57	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Apache Struts	7 Sep 201708:49	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Gnu Bash	2 Jan 201700:52	–	githubexploit

Vulners

Node

apache struts2-coreRange2.5-BETA1–2.5.12java

apache struts2-coreRange2.3.7–2.3.33java

apache xwork-coreRange2.3.20–2.3.33java

Source	Link
struts	www.struts.apache.org/docs/s2-050.html
securityfocus	www.securityfocus.com/bid/100612
securitytracker	www.securitytracker.com/id/1039261
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2
sourceclear	www.sourceclear.com/registry/security/remote-code-execution-rce-/java/sid-4568/summary
security	www.security.netapp.com/advisory/ntap-20180629-0001/
arubanetworks	www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt
oracle	www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html

29 Sep 2020 05:14Current

7.4High risk

Vulners AI Score7.4

CVSS 25

CVSS 37.5

EPSS0.94322