{"id":"CVE-2017-9787","published":"2017-07-13T15:00:00Z","modified":"2024-09-17T02:47:37Z","title":"When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack","vendor":"Apache","product":"Apache Struts","tier":"tail","description":{"text":"When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.10554,"percentile":0.95757,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securitytracker.com/id/1039115","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://lists.apache.org/thread.html/de3d325f0433cd3b42258b6a302c0d7a72b69eedc1480ed561d3b065%40%3Cannouncements.struts.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.securityfocus.com/bid/99562","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://security.netapp.com/advisory/ntap-20180706-0002/","tags":["x_refsource_CONFIRM"]},{"url":"http://struts.apache.org/docs/s2-049.html","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.apache.org/thread.html/3795c4dd46d9ec75f4a6eb9eca11c11edd3e796c6c1fd7b17b5dc50d%40%3Cannouncements.struts.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":19.2,"factors":[{"name":"EPSS percentile","points":19.15}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Struts","versions":["2.3.x prior to 2.3.33","2.5 to 2.5.10.1"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.3.7, <2.3.33",">=2.5.0, <2.5.12"],"patched":["2.3.33","2.5.12"],"from":["GHSA-8mr5-h28g-36qx"],"provenance":"source"}],"euvd":{"id":"EUVD-2018-0551","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-struts-cve-2013-1965","parents":[{"from":"CVE-2013-1965","to":"CVE-2017-9787","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["xwork-core/src/main/java/com/opensymphony/xwork2/XWorkConstants.java","xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java"],"commits":["https://github.com/apache/struts/commit/7e6f641ebb142663cbd1653dc49bed725edf7f56","https://github.com/apache/struts/commit/086b63735527d4bb0c1dd0d86a7c0374b825ff24","https://github.com/apache/struts/commit/0d6442bab5b44d93c4c2e63c5335f0a331333b92"],"basis":"shared function","functions":["OgnlUtil","XWorkConstants"]}]},{"from":"CVE-2013-1966","to":"CVE-2017-9787","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["xwork-core/src/main/java/com/opensymphony/xwork2/XWorkConstants.java","xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java"],"commits":["https://github.com/apache/struts/commit/7e6f641ebb142663cbd1653dc49bed725edf7f56","https://github.com/apache/struts/commit/086b63735527d4bb0c1dd0d86a7c0374b825ff24","https://github.com/apache/struts/commit/0d6442bab5b44d93c4c2e63c5335f0a331333b92"],"basis":"shared function","functions":["OgnlUtil","XWorkConstants"]}]}],"packageHistory":[{"cve":"CVE-2017-5638","published":"2017-03-11","fixed":"2.5.10.1","kev":true,"link":{"from":"CVE-2017-5638","to":"CVE-2017-9787","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts:struts2-core","fromFixed":"2.3.32","toFixed":"2.3.33","daysApart":124}]}},{"cve":"CVE-2017-12611","published":"2017-09-20","fixed":"2.5.11","kev":false,"link":{"from":"CVE-2017-9787","to":"CVE-2017-12611","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts:struts2-core","fromFixed":"2.3.33","toFixed":"2.3.34","daysApart":69}]}},{"cve":"CVE-2017-7672","published":"2017-07-13","fixed":"2.5.12","kev":false},{"cve":"CVE-2017-9787","published":"2017-07-13","fixed":"2.5.12","kev":false},{"cve":"CVE-2016-4465","published":"2016-07-04","fixed":"2.5.13","kev":false},{"cve":"CVE-2016-8738","published":"2017-09-20","fixed":"2.5.13","kev":false,"link":{"from":"CVE-2017-9787","to":"CVE-2016-8738","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts:struts2-core","fromFixed":"2.5.12","toFixed":"2.5.13","daysApart":69}]}},{"cve":"CVE-2017-9804","published":"2017-09-20","fixed":"2.5.13","kev":false,"link":{"from":"CVE-2017-9787","to":"CVE-2017-9804","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts:struts2-core","fromFixed":"2.3.33","toFixed":"2.3.34","daysApart":69}]}}],"package":"Maven:org.apache.struts:struts2-core"}}