The REST Plugin in Apache Struts 2.1.1 up to and including 2.3.x prior to 2.3.34 and 2.5.x prior to 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
apache struts 2.1.8 |
||
apache struts 2.1.8.1 |
||
apache struts 2.3.1.2 |
||
apache struts 2.3.3 |
||
apache struts 2.3.14.2 |
||
apache struts 2.3.14.3 |
||
apache struts 2.3.16.2 |
||
apache struts 2.3.16.3 |
||
apache struts 2.3.28 |
||
apache struts 2.3.28.1 |
||
apache struts 2.5.3 |
||
apache struts 2.5.4 |
||
apache struts 2.5.10.1 |
||
apache struts 2.5.11 |
||
apache struts 2.1.2 |
||
apache struts 2.2.1 |
||
apache struts 2.2.1.1 |
||
apache struts 2.3.4 |
||
apache struts 2.3.4.1 |
||
apache struts 2.3.15 |
||
apache struts 2.3.15.1 |
||
apache struts 2.3.20 |
||
apache struts 2.3.20.1 |
||
apache struts 2.3.29 |
||
apache struts 2.3.30 |
||
apache struts 2.5.5 |
||
apache struts 2.5.6 |
||
apache struts 2.5.12 |
||
apache struts 2.1.5 |
||
apache struts 2.1.6 |
||
apache struts 2.3.1 |
||
apache struts 2.3.1.1 |
||
apache struts 2.3.12 |
||
apache struts 2.3.14 |
||
apache struts 2.3.14.1 |
||
apache struts 2.3.16 |
||
apache struts 2.3.16.1 |
||
apache struts 2.3.24.1 |
||
apache struts 2.3.24.3 |
||
apache struts 2.3.33 |
||
apache struts 2.5.1 |
||
apache struts 2.5.2 |
||
apache struts 2.5.9 |
||
apache struts 2.5.10 |
||
apache struts 2.1.3 |
||
apache struts 2.1.4 |
||
apache struts 2.2.3 |
||
apache struts 2.2.3.1 |
||
apache struts 2.3.7 |
||
apache struts 2.3.8 |
||
apache struts 2.3.15.2 |
||
apache struts 2.3.15.3 |
||
apache struts 2.3.20.3 |
||
apache struts 2.3.24 |
||
apache struts 2.3.31 |
||
apache struts 2.3.32 |
||
apache struts 2.5.7 |
||
apache struts 2.5.8 |
Big Red issues out-of-band patch for Apache and a few other urgent issues
Oracle has stepped outside its usual quarterly security fix cycle to address the latest Apache Struts 2 vulnerability. Ever since it emerged at the start of September, CVE-2017-9805 has been (in the words of a former Australian prime minister) “a shiver looking for a spine to crawl up”, because so many vendors use Apache to build Web interfaces and bake Struts 2 into their their Web application framework. Big Red's sprawling product set meant fixes had to be deployed across more than 20 prod...
Timeline explains that either Equifax didn't patch old bugs, or was zero-dayed
The Apache Software Foundation has defended its development practices in the face of a report alleging its code was responsible for the Equifax data leak. QZ.com, an outlet run by Atlantic Media, alleged that the hack was the result of an attack on Apache Struts, which as we reported last week was found to have a flaw allowing malware to be injected into corporate networks. The outlet pointed out that the flaw may have been present in Struts for nine years. Which has Apache antsy, as it's not wi...
All versions of app framework since 2008 affected – so patch!
Malicious code can be pushed into servers running Apache Struts 2 apps, allowing scumbags to run malware within corporate networks. The critical security vulnerability was discovered by researchers at Semmle, who today went public with their find. Apache Struts is a popular open-source framework for developing applications in Java. All versions of Struts since 2008 are affected and all web applications using the framework’s popular REST plugin are vulnerable – exposing organizations...