Security Advisory

CVE-2017-9805

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2017-09-15 19:00:00

Last updated 2025-10-21 23:55:34

Assigner apache

CVSS score not scored

State PUBLISHED

Description

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

← Browse all CVEs View on cve.org ↗