CVE-2017-15707

Summary

CVE	CVE-2017-15707
State	PUBLISHED
Assigner	apache
Source Priority	CVE Program / NVD first with legacy fallback
Published	2017-12-01 16:29:00 UTC
Updated	2025-04-20 01:37:25 UTC
Description	In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.

Risk And Classification

Primary CVSS: v3.0 6.2 MEDIUM from [email protected]

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.015340000 probability, percentile 0.815110000 (date 2026-05-14)

Problem Types: CWE-20 | DoS attack

Version	Source	Type	Score	Severity	Vector
3.0	[email protected]	Primary	6.2	MEDIUM	`CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
2.0	[email protected]	Primary	5		`AV:N/AC:L/Au:N/C:N/I:N/A:P`

CVSS v3.0 Breakdown

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v2.0 Breakdown

Access Vector

Network

Access Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

AV:N/AC:L/Au:N/C:N/I:N/A:P

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Apache	Struts	All	All	All	All
Application	Netapp	Oncommand Balance	-	All	All	All
Application	Oracle	Agile Plm Framework	9.3.6	All	All	All
Application	Oracle	Enterprise Manager For Virtualization	13.2.2	All	All	All
Application	Oracle	Enterprise Manager For Virtualization	13.2.3	All	All	All
Application	Oracle	Financial Services Hedge Management And Ifrs Valuations	8.0.4	All	All	All
Application	Oracle	Financial Services Hedge Management And Ifrs Valuations	8.0.5	All	All	All
Application	Oracle	Financial Services Market Risk Measurement And Management	8.0.5	All	All	All
Application	Oracle	Global Lifecycle Management Opatchauto	All	All	All	All
Application	Oracle	Jd Edwards Enterpriseone Tools	9.2	All	All	All
Application	Oracle	Retail Order Broker	5.2	All	All	All
Application	Oracle	Retail Xstore Point Of Service	15.0.1	All	All	All
Application	Oracle	Retail Xstore Point Of Service	16.0.2	All	All	All
Application	Oracle	Retail Xstore Point Of Service	6.5.11	All	All	All
Application	Oracle	Retail Xstore Point Of Service	7.0.6	All	All	All
Application	Oracle	Retail Xstore Point Of Service	7.1.6	All	All	All
Application	Oracle	Webcenter Portal	12.2.1.2.0	All	All	All
Application	Oracle	Webcenter Portal	12.2.1.3.0	All	All	All
Application	Oracle	Weblogic Server	12.2.1.2	All	All	All
Application	Oracle	Weblogic Server	12.2.1.3	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Apache Software Foundation	Apache Struts	affected 2.5 to 2.5.14	Not specified

References

Reference	Source	Link	Tags
S2-054 - Apache Struts 2 Documentation - Apache Software Foundation	af854a3a-2127-422b-91ae-364da2661108	cwiki.apache.org	Patch, Vendor Advisory
Apache Struts REST Plugin JSON Library Bug Lets Remote Users Deny Service - SecurityTracker	af854a3a-2127-422b-91ae-364da2661108	www.securitytracker.com	Third Party Advisory, VDB Entry
Apache Struts CVE-2017-15707 Denial of Service Vulnerability	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com	Third Party Advisory, VDB Entry
Oracle Critical Patch Update - April 2018	af854a3a-2127-422b-91ae-364da2661108	www.oracle.com	Patch
CPU July 2018	af854a3a-2127-422b-91ae-364da2661108	www.oracle.com	Patch
CVE-2017-15707 Apache Struts Vulnerability in NetApp Products \| NetApp Product Security	af854a3a-2127-422b-91ae-364da2661108	security.netapp.com	Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

980793 Java (maven) Security Update for org.apache.struts:struts2-rest-plugin (GHSA-xcrm-qpp8-hcw4)