CVE-2017-9804 (GCVE-0-2017-9804)

Vulnerability from cvelistv5 – Published: 2017-09-20 17:00 – Updated: 2024-09-17 03:37
VLAI
Summary
In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.
Severity
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
  • A regular expression Denial of Service when using URLValidator (similar to S2-044 & S2-047)
Assigner
apache CNA under the mitre root
CNA scorecard B 76/100 over 936 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Apache Software Foundation Apache Struts Affected: 2.3.7 - 2.3.33
Affected: 2.5 - 2.5.12
guessed Create a notification for this product.
Date Public
2017-09-05 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T17:18:01.933Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html"
          },
          {
            "name": "20170907 Multiple Vulnerabilities in Apache Struts 2 Affecting Cisco Products: September 2017",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2"
          },
          {
            "name": "100612",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/100612"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20180629-0001/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt"
          },
          {
            "name": "1039261",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1039261"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://struts.apache.org/docs/s2-050.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Struts",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "2.3.7 - 2.3.33"
            },
            {
              "status": "affected",
              "version": "2.5 - 2.5.12"
            }
          ]
        }
      ],
      "datePublic": "2017-09-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.  NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "A regular expression Denial of Service when using URLValidator (similar to S2-044 \u0026 S2-047)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-06-30T09:57:01.000Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html"
        },
        {
          "name": "20170907 Multiple Vulnerabilities in Apache Struts 2 Affecting Cisco Products: September 2017",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2"
        },
        {
          "name": "100612",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/100612"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20180629-0001/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt"
        },
        {
          "name": "1039261",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1039261"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://struts.apache.org/docs/s2-050.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "DATE_PUBLIC": "2017-09-05T00:00:00",
          "ID": "CVE-2017-9804",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Struts",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2.3.7 - 2.3.33"
                          },
                          {
                            "version_value": "2.5 - 2.5.12"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.  NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "A regular expression Denial of Service when using URLValidator (similar to S2-044 \u0026 S2-047)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html"
            },
            {
              "name": "20170907 Multiple Vulnerabilities in Apache Struts 2 Affecting Cisco Products: September 2017",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2"
            },
            {
              "name": "100612",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/100612"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20180629-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20180629-0001/"
            },
            {
              "name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt",
              "refsource": "CONFIRM",
              "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt"
            },
            {
              "name": "1039261",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1039261"
            },
            {
              "name": "https://struts.apache.org/docs/s2-050.html",
              "refsource": "CONFIRM",
              "url": "https://struts.apache.org/docs/s2-050.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2017-9804",
    "datePublished": "2017-09-20T17:00:00.000Z",
    "dateReserved": "2017-06-21T00:00:00.000Z",
    "dateUpdated": "2024-09-17T03:37:30.803Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2017-9804",
      "date": "2026-10-12",
      "epss": "0.08237",
      "percentile": "0.9478"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:*",
                    "matchCriteriaId": "443B4E64-2A36-49C6-B09D-77B3BDF69709",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2481505C-4FD1-4195-9E10-9DD741498FB2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.9:*:*:*:*:*:*:*",
                    "matchCriteriaId": "910DCB81-63A8-4BBB-8897-A98A0F2AEEB4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.10:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F75F4616-4B4B-4CAB-968B-502179152D2B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.11:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D3D12A0A-1DC5-47C7-9FF6-E8103C75FE76",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:*",
                    "matchCriteriaId": "28ED63DB-2AAF-4BC9-A844-074EDF63C89A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.13:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C86232DA-90C7-43F8-99CC-C1BFB4BA3F9A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:*",
                    "matchCriteriaId": "38A6CEED-6C43-4325-B36C-9F254CCDFDC0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "41F43088-26AA-4890-A9D6-1B9B48D5F02A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BE6820E3-8FDF-4BDF-8B62-E604A91F1280",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D25ED06A-F12C-443E-9B3F-FDDF52FE9D93",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:*",
                    "matchCriteriaId": "44527919-8403-42A8-9CE1-3B4F58630F34",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EBB91D8A-14B8-4263-B90D-F776535F9B8F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FB525941-7175-43C1-9F17-814F5F7C72CA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F10D559E-04A0-4002-947C-D3902138795B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:*",
                    "matchCriteriaId": "89203DD8-2C95-4546-9504-83654FFA5DBC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EB3D5644-CFAC-4FB5-A1FB-387F97876098",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1225A0B0-C3F2-4579-BFE9-F8DB2CF596F6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8DC883A7-0766-4857-ABC8-9DB4BA713650",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.17:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D3553904-BF3C-4636-947A-8AA16D4F38A5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.19:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E93CE807-D7C2-4865-ACF8-E366A6478B46",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:*",
                    "matchCriteriaId": "22FF6282-0BCA-46EB-9648-6EE3EDA189F2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6D1467BC-9BC8-402D-A420-615CF9698648",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.20.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "12CE716B-867F-49CA-BDAF-194714D990C1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.21:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CB6057D5-0787-4026-A202-ACD07C862F8D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.22:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1B3AE8EA-4D25-4151-A210-ECDE802F8A2F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.23:*:*:*:*:*:*:*",
                    "matchCriteriaId": "79C615AE-4709-47EB-85F8-BD944096428E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.24.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "39047809-4E6D-4670-B9BA-D8FD910E38EB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "71823E13-1896-4EE4-A49C-CFFB717FFD80",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.25:*:*:*:*:*:*:*",
                    "matchCriteriaId": "291F3624-8AB5-46F2-9BB5-F592DF1C9F88",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.26:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DD053675-DE5E-40A8-B404-4F36AAC82502",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.27:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B0392E61-6D77-43C3-8009-96BC0F90B8D1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C778ADED-75B5-4AD3-8CDC-EFDFFAD5A742",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "067F6249-CC5A-4402-843C-06D5F9F77267",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0AFA78DD-B60C-46AD-BCCB-4E15BB16BEDC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1DA1EABE-5292-44C2-8327-54201A42F204",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.31:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F327A6EA-69AF-4EB2-8F17-8011678FAB6D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.32:*:*:*:*:*:*:*",
                    "matchCriteriaId": "603FAA0C-0908-4105-BE3A-016B4A298264",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.3.33:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8E5068CA-A472-47D2-A89F-A43EA8617874",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.5:*:*:*:*:*:*:*",
                    "matchCriteriaId": "63CE1226-E0E6-4DC6-AC89-3FFDE6BD7B77",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.5:beta1:*:*:*:*:*:*",
                    "matchCriteriaId": "E17D62B8-349B-4F30-8849-6912828802C3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.5:beta2:*:*:*:*:*:*",
                    "matchCriteriaId": "D5E91133-D585-43F7-9093-94D735B3167E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.5:beta3:*:*:*:*:*:*",
                    "matchCriteriaId": "DD44FD72-ECE7-4E08-AD9E-5CE2C310C2C8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.5.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A4F914BA-CF16-4B03-A6A2-8C9816EC1248",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.5.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D2C82970-62C9-4513-A66D-6BDA4048C27F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.5.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E1A43CA5-46DE-4513-A309-BE3A60CD5489",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.5.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1D83D2FA-8931-45F8-82D6-DE270A2BA55C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.5.5:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0D284BF2-101C-490C-85CB-69D156D1FF77",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.5.6:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5BAD7A75-378F-4A0F-A10F-E4F7AF60F285",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.5.7:*:*:*:*:*:*:*",
                    "matchCriteriaId": "56E43496-097F-4560-BFB1-BDDA4659F197",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.5.8:*:*:*:*:*:*:*",
                    "matchCriteriaId": "96C720D6-312B-477C-A993-BEE39A7ADB4E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.5.9:*:*:*:*:*:*:*",
                    "matchCriteriaId": "03367A87-9011-45F4-B534-DEA26F8D4567",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.5.10:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CF635DCE-D495-4166-9E25-1E48DDDF9AAC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.5.10.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "725DBE04-720B-421E-B76A-4EE92FEE171C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:struts:2.5.12:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0F36F794-B949-40DB-986A-EDB0E6619100",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.  NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672."
          },
          {
            "lang": "es",
            "value": "En Apache Struts desde la versi\u00f3n 2.3.7 hasta la 2.3.33 y desde la 2.5 hasta la 2.5.12, si una aplicaci\u00f3n permite la introducci\u00f3n de una URL en un campo de un formulario y se emplea URLValidator (integrado), es posible preparar una URL especial que ser\u00e1 usada para sobrecargar el proceso del servidor cuando se lleva a cabo la validaci\u00f3n de la URL. NOTA: Esta vulnerabilidad existe debido a una soluci\u00f3n incompleta para S2-047 / CVE-2017-7672."
          }
        ],
        "id": "CVE-2017-9804",
        "lastModified": "2026-05-13T00:24:29.033",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 5.0,
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV30": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.0"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2017-09-20T17:29:00.620",
        "references": [
          {
            "source": "security@apache.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt"
          },
          {
            "source": "security@apache.org",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html"
          },
          {
            "source": "security@apache.org",
            "tags": [
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "http://www.securityfocus.com/bid/100612"
          },
          {
            "source": "security@apache.org",
            "tags": [
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "http://www.securitytracker.com/id/1039261"
          },
          {
            "source": "security@apache.org",
            "url": "https://security.netapp.com/advisory/ntap-20180629-0001/"
          },
          {
            "source": "security@apache.org",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://struts.apache.org/docs/s2-050.html"
          },
          {
            "source": "security@apache.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "http://www.securityfocus.com/bid/100612"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "http://www.securitytracker.com/id/1039261"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://security.netapp.com/advisory/ntap-20180629-0001/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://struts.apache.org/docs/s2-050.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2"
          }
        ],
        "sourceIdentifier": "security@apache.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-05-13T01:42:21+00:00",
      "cve": "CVE-2017-9804",
      "id": "CVE-2017-9804",
      "initial_release_date": "2017-09-05T00:00:00+00:00",
      "product_status:known_not_affected": "5",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "struts: A regular expression Denial of Service when using URLValidator",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2017/cve-2017-9804.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.