CVE-2017-9804

In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is…

published September 20, 2017

CVSS
—
EPSS
8%
Percentile
94.9
In the wild
Unconfirmed
What it is

In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.08237 · 94.9th percentile
Published
2017-09-20T17:00Z
EPSS history
Timeline
  • 20 SEP 17:00Z
    In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is…
    cvelistv5