org.apache.struts CVEs

VRT Sign in

Look up CVE IDs Status Exploitation Severity

Reset

Overview 3 matches · 1 protected · 1 exploited · 1 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5

3matches 1protected33.3% 1exploited33.3% 1CISA KEV33.3% 1public PoC33.3% 1EPSS ≥ 0.533.3%

Protected by Waratek 1 33.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 66.7%

Critical 1 33.3% High 1 33.3% Medium 1 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 1 33.3% partly blocked 0 0.0% not blocked 2 66.7% not established 0 0.0% unrecorded 0 0.0%

Exploited 1 33.3% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 66.7%

split by StatusSeverityProtectionExploit maturity peak 3 / month

Jul 173 Protected by Waratek1 No exploit published2 Critical1 High1 Medium1 blocked by ARMR today1 not blocked2 Exploited1 No public exploit2

Jul 17

3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2017-9787	High	2017-07-13	No exploit published	No public exploit	When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33.
CVE-2017-7672	Medium	2017-07-13	No exploit published	No public exploit	If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12.
CVE-2017-9791	Critical	2017-07-10	Protected by Waratek	Exploited	The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2017-9787

High

2017-07-13

No exploit published

No public exploit

When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33.

CVE-2017-7672

Medium

2017-07-13

No exploit published

No public exploit

If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12.

CVE-2017-9791

Critical

2017-07-10

Protected by Waratek

Exploited

The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.