Oracle releases security patches for Apache Struts CVE-2017
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2017-12611+2 related CVEs | In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a… | 9.8 group max | 87% | PoC | |
| CVE-2017-5638 | Unauthenticated RCE in Apache Struts Jakarta Multipart parser | 9.8 | 100% | KEVRansomwarePoC ×10 | KEV |
CVE-2017-9787+1 related CVE | When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack | 7.5 group max | 11% | ||
| CVE-2017-9791 | Unauthenticated RCE via Improper Input Validation in Apache Struts 1 Plugin | 9.8 | 99% | KEV | KEV |
| CVE-2017-9805 | XML Deserialization RCE in Apache Struts 2 REST Plugin | 8.1 | 99% | KEVPoC | KEV |
From the original article
2 min read at securityaffairs.comOracle fixed several issues in the Apache Struts 2 framework including the flaw CVE-2017-9805 that has been exploited in the wild for the past few weeks. Oracle has released patches for vulnerabilities affecting many of its products, the IT giant has fixed several issues in the Apache Struts 2 framework, including the flaw CVE-2017-9805 that has been exploited in the wild for the past few weeks.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.