Apache Struts CVE-2017-9805 Remote Code Execution Vulnerability

BID:100609

Info

Apache Struts CVE-2017-9805 Remote Code Execution Vulnerability

Bugtraq ID: 100609
Class: Input Validation Error
CVE: CVE-2017-9805
Remote: Yes
Local: No
Published: Sep 05 2017 12:00AM
Updated: Sep 27 2017 10:00AM
Credit: Man Yue Mo
Vulnerable: XStream XStream 0
Oracle Weblogic Server 10.3.6 0
Oracle Weblogic Server 12.2.1.3
Oracle Weblogic Server 12.2.1.2
Oracle Weblogic Server 12.2.1.1
Oracle Weblogic Server 12.2.1.0
Oracle Weblogic Server 12.1.3.0
Oracle Siebel Applications 7.1
Oracle Siebel Applications 6.2
Oracle Siebel Applications 6.1
Oracle MySQL Enterprise Monitor 3.2.1182
Oracle MySQL Enterprise Monitor 3.4.2.4181
Oracle MySQL Enterprise Monitor 3.4.1
Oracle MySQL Enterprise Monitor 3.4.0
Oracle MySQL Enterprise Monitor 3.3.4.3247
Oracle MySQL Enterprise Monitor 3.3.3.1199
Oracle MySQL Enterprise Monitor 3.3.2.1162
Oracle MySQL Enterprise Monitor 3.3.0.1098
Oracle MySQL Enterprise Monitor 3.2.8.2223
Oracle MySQL Enterprise Monitor 3.2.7.1204
Oracle MySQL Enterprise Monitor 3.2.5.1141
Oracle MySQL Enterprise Monitor 3.2.4.1102
Oracle MySQL Enterprise Monitor 3.2.1.1049
Oracle MICROS Retail XBRi Loss Prevention 10.8.1
Oracle MICROS Retail XBRi Loss Prevention 10.8
Oracle MICROS Retail XBRi Loss Prevention 10.7
Oracle MICROS Retail XBRi Loss Prevention 10.6
Oracle MICROS Retail XBRi Loss Prevention 10.5
Oracle MICROS Retail XBRi Loss Prevention 10.0.1
Oracle Insurance Performance Insight for General Insurance 8.0
Oracle Insurance Data Foundation 8.0.5
Oracle Insurance Data Foundation 8.0.4
Oracle Insurance Data Foundation 8.0.3
Oracle Insurance Data Foundation 8.0.2
Oracle Insurance Data Foundation 8.0.1
Oracle FLEXCUBE Private Banking 12.1
Oracle FLEXCUBE Private Banking 12.0.3
Oracle FLEXCUBE Private Banking 12.0.2
Oracle FLEXCUBE Private Banking 12.0.1
Oracle FLEXCUBE Private Banking 12.0
Oracle FLEXCUBE Private Banking 2.2
Oracle FLEXCUBE Private Banking 2.1
Oracle FLEXCUBE Private Banking 3.0
Oracle FLEXCUBE Private Banking 2.0
Oracle Financial Services Retail Performance Analytics 8.0.5
Oracle Financial Services Retail Performance Analytics 8.0.4
Oracle Financial Services Retail Performance Analytics 8.0.3
Oracle Financial Services Retail Performance Analytics 8.0.2
Oracle Financial Services Retail Performance Analytics 8.0.1
Oracle Financial Services Retail Performance Analytics 8.0
Oracle Financial Services Retail Customer Analytics 8.0.5
Oracle Financial Services Retail Customer Analytics 8.0.4
Oracle Financial Services Retail Customer Analytics 8.0.3
Oracle Financial Services Retail Customer Analytics 8.0.2
Oracle Financial Services Retail Customer Analytics 8.0.1
Oracle Financial Services Retail Customer Analytics 8.0
Oracle Financial Services Profitability Management 8.0.5
Oracle Financial Services Profitability Management 8.0.4
Oracle Financial Services Profitability Management 8.0.3
Oracle Financial Services Profitability Management 8.0.2
Oracle Financial Services Profitability Management 8.0.1
Oracle Financial Services Profitability Management 6.1.1
Oracle Financial Services Profitability Management 6.1
Oracle Financial Services Profitability Management 6.0
Oracle Financial Services Pricing Management 8.0.5
Oracle Financial Services Pricing Management 8.0.4
Oracle Financial Services Pricing Management 8.0
Oracle Financial Services Price Creation and Discovery 8.0.5
Oracle Financial Services Price Creation and Discovery 8.0.4
Oracle Financial Services Price Creation and Discovery 8.0
Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.5
Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.4
Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.3
Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.2
Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.1
Oracle Financial Services Loan Loss Forecasting and Provisioning 1.5.1
Oracle Financial Services Loan Loss Forecasting and Provisioning 1.5
Oracle Financial Services Liquidity Risk Management 8.0.4
Oracle Financial Services Liquidity Risk Management 8.0.2
Oracle Financial Services Liquidity Risk Management 8.0.1
Oracle Financial Services Institutional Performance Analytics 8.0.5
Oracle Financial Services Institutional Performance Analytics 8.0.4
Oracle Financial Services Institutional Performance Analytics 8.0.3
Oracle Financial Services Institutional Performance Analytics 8.0.2
Oracle Financial Services Institutional Performance Analytics 8.0.1
Oracle Financial Services Institutional Performance Analytics 8.0
Oracle Financial Services ICAAP Analytics 8.0
Oracle Financial Services Hedge Management and IFRS Valuations 8.0.5
Oracle Financial Services Hedge Management and IFRS Valuations 8.0.4
Oracle Financial Services Hedge Management and IFRS Valuations 8.0.3
Oracle Financial Services Hedge Management and IFRS Valuations 8.0.2
Oracle Financial Services Hedge Management and IFRS Valuations 8.0.1
Oracle Financial Services Hedge Management and IFRS Valuations 6.1.1
Oracle Financial Services Funds Transfer Pricing 8.0.5
Oracle Financial Services Funds Transfer Pricing 8.0.4
Oracle Financial Services Funds Transfer Pricing 8.0.3
Oracle Financial Services Funds Transfer Pricing 8.0.2
Oracle Financial Services Funds Transfer Pricing 8.0.1
Oracle Financial Services Funds Transfer Pricing 6.1.1
Oracle Financial Services Funds Transfer Pricing 6.1
Oracle Financial Services Funds Transfer Pricing 6.0
Oracle Financial Services Enterprise Financial Performance Analytics 8.0.5
Oracle Financial Services Enterprise Financial Performance Analytics 8.0.4
Oracle Financial Services Enterprise Financial Performance Analytics 8.0.3
Oracle Financial Services Enterprise Financial Performance Analytics 8.0.2
Oracle Financial Services Enterprise Financial Performance Analytics 8.0.1
Oracle Financial Services Enterprise Financial Performance Analytics 8.0
Oracle Financial Services Data Integration Hub 8.0.4
Oracle Financial Services Data Integration Hub 8.0.3
Oracle Financial Services Data Integration Hub 8.0.2
Oracle Financial Services Data Integration Hub 8.0.1
Oracle Financial Services Data Foundation 8.0.5
Oracle Financial Services Data Foundation 8.0.4
Oracle Financial Services Data Foundation 8.0.3
Oracle Financial Services Data Foundation 8.0.2
Oracle Financial Services Data Foundation 8.0.1
Oracle Financial Services Data Foundation 7.4
Oracle Financial Services Data Foundation 7.3
Oracle Financial Services Basel Regulatory Capital Internal Ratings Bas 8.0.4
Oracle Financial Services Basel Regulatory Capital Internal Ratings Bas 8.0.3
Oracle Financial Services Basel Regulatory Capital Internal Ratings Bas 8.0.2
Oracle Financial Services Basel Regulatory Capital Internal Ratings Bas 8.0.1
Oracle Financial Services Basel Regulatory Capital Basic 8.0.4
Oracle Financial Services Basel Regulatory Capital Basic 8.0.3
Oracle Financial Services Basel Regulatory Capital Basic 8.0.2
Oracle Financial Services Basel Regulatory Capital Basic 8.0.1
Oracle Financial Services Asset Liability Management 8.0.5
Oracle Financial Services Asset Liability Management 8.0.4
Oracle Financial Services Asset Liability Management 8.0.3
Oracle Financial Services Asset Liability Management 8.0.2
Oracle Financial Services Asset Liability Management 8.0.1
Oracle Financial Services Asset Liability Management 6.1.1
Oracle Financial Services Asset Liability Management 6.1
Oracle Financial Services Asset Liability Management 6.0
Oracle Financial Services Analytical Applications Reconciliation 8.0.4
Oracle Financial Services Analytical Applications Reconciliation 8.0.3
Oracle Financial Services Analytical Applications Reconciliation 8.0.2
Oracle Financial Services Analytical Applications Reconciliation 8.0.1
Oracle Financial Services Analytical Applications Reconciliation 8.0
Oracle Financial Services Analytical Applications Reconciliation 3.5.1
Oracle Financial Services Analytical Applications Reconciliation 3.5
Oracle Financial Services Analytical Applications Infrastructure 7.3
Oracle Financial Services Analytical Applications Infrastructure 7.2
Oracle Communications Policy Management 12.1.1
Oracle Communications Policy Management 12.1
Oracle Communications Policy Management 11.5
Oracle Communications Policy Management 12.2
Cisco Video Distribution Suite for Internet Streaming (VDS-IS/CDS-IS) 0
Cisco Unified Intelligent Contact Management Enterprise 0
Cisco Unified Contact Center Enterprise 0
Cisco Network Performance Analysis 0
Cisco MXE 3500 Series Media Experience Engines 0
Cisco Hosted Collaboration Solution for Contact Center 0
Cisco Digital Media Manager (DMM) 0
Apache Struts 2.3.31
Apache Struts 2.3.30
Apache Struts 2.3.28
Apache Struts 2.3.24
Apache Struts 2.3.5
Apache Struts 2.3.4 1
Apache Struts 2.3.4
Apache Struts 2.2.3
Apache Struts 2.2.1 1
Apache Struts 2.2
Apache Struts 2.1.8
Apache Struts 2.1.6
Apache Struts 2.1.5
Apache Struts 2.1.2
Apache Struts 2.1.1
Apache Struts 2.5.9
Apache Struts 2.5.8
Apache Struts 2.5.7
Apache Struts 2.5.6
Apache Struts 2.5.5
Apache Struts 2.5.4
Apache Struts 2.5.3
Apache Struts 2.5.2
Apache Struts 2.5.12
Apache Struts 2.5.11
Apache Struts 2.5.10
Apache Struts 2.5.1
Apache Struts 2.5
Apache Struts 2.3.8
Apache Struts 2.3.7
Apache Struts 2.3.33
Apache Struts 2.3.32
Apache Struts 2.3.29
Apache Struts 2.3.28.1
Apache Struts 2.3.24.3
Apache Struts 2.3.24.2
Apache Struts 2.3.24.1
Apache Struts 2.3.20.3
Apache Struts 2.3.20.2
Apache Struts 2.3.20.1
Apache Struts 2.3.20
Apache Struts 2.3.16.3
Apache Struts 2.3.16.2
Apache Struts 2.3.16.1
Apache Struts 2.3.16
Apache Struts 2.3.15.3
Apache Struts 2.3.15.2
Apache Struts 2.3.15.1
Apache Struts 2.3.15
Apache Struts 2.3.14.3
Apache Struts 2.3.14.2
Apache Struts 2.3.14.1
Apache Struts 2.3.14
Apache Struts 2.3.1.2
Apache Struts 2.3.1.1
Apache Struts 2.3.1
Apache Struts 2.2.3.1
Apache Struts 2.1.4
Apache Struts 2.1.3
Not Vulnerable: Apache Struts 2.5.13
Apache Struts 2.3.34

Exploit / POC

Apache Struts CVE-2017-9805 Remote Code Execution Vulnerability

The following exploit code is available:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report