The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
| Link | Tags |
|---|---|
| http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html | third party advisory patch |
| http://www.securityfocus.com/bid/99484 | vdb entry third party advisory |
| https://www.exploit-db.com/exploits/42324/ | exploit vdb entry third party advisory |
| http://struts.apache.org/docs/s2-048.html | mitigation vendor advisory |
| http://www.securitytracker.com/id/1038838 | vdb entry third party advisory |
| https://www.exploit-db.com/exploits/44643/ | exploit vdb entry third party advisory |
| https://security.netapp.com/advisory/ntap-20180706-0002/ | third party advisory |