Veracode Vulnerability DatabaseVERACODE:6021Denial Of Service (DoS)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
Apache Struts REST plugin is vulnerable to denial of service (DoS) attacks. The application uses a version of the xstream library before version 1.4.10, which can crash when attempting to unmarshal void. This is related to CVE-2017-7957.
| CPE | Name | Operator | Version |
|---|---|---|---|
| struts 2 rest plugin | le | 2.5.12 | |
| struts 2 rest plugin | le | 2.3.33 |
References
www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
www.securityfocus.com/bid/103516
www.securitytracker.com/id/1040575
cwiki.apache.org/confluence/display/WW/S2-056
github.com/apache/struts/commit/26babb6fdf385e624f187bbf3127bd56ee5f5e9c
issues.apache.org/jira/browse/WW-4922
lists.apache.org/thread.html/r02c2d634fa74209d941c90f9a4cd36a6f12366ca65f9b90446ff2de3@%3Cissues.struts.apache.org%3E
lists.apache.org/thread.html/rf482c101a88445d73cc2e89dbf7f16ae00a4aa79a544a1e72b2326db@%3Cissues.struts.apache.org%3E
security.netapp.com/advisory/ntap-20180330-0001/
www.sourceclear.com/vulnerability-database/security/denial-of-service-dos-/java/sid-4053/summary
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P