CVE-2017-9793
The REST Plugin in Apache Struts is using an outdated XStream library
The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.
- Record
CVE-2017-9793- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.
- Record
CVE-2017-9793- Updated
- 2026-11-02
EUVDEUVD-2018-0702 No score
The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.
- Record
EUVD-2018-0702- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vwxj-6m5m-rrvh
The REST Plugin in Apache Struts is using an outdated XStream library
The REST Plugin in Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.
- Record
GHSA-vwxj-6m5m-rrvh- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.
- Record
CVE-2017-9793- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-vwxj-6m5m-rrvh
The REST Plugin in Apache Struts is using an outdated XStream library
The REST Plugin in Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.
- Record
GHSA-vwxj-6m5m-rrvh- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts:struts2-rest-pluginMaven |
2.5.0 to 2.5.12 | 2.5.13 |
org.apache.struts:struts2-rest-pluginMaven |
before 2.3.34 | 2.3.34 |
org.apache.struts:struts2-rest-pluginMaven |
before 2.3.34, plus listed versions 2.1.22.1.62.1.82.1.8.12.2.1 Show 37 moreShow less2.2.1.12.2.32.2.3.12.3.12.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.15.22.3.15.32.3.162.3.16.12.3.16.22.3.16.32.3.202.3.20.12.3.20.32.3.242.3.24.12.3.24.32.3.282.3.28.12.3.292.3.32.3.302.3.312.3.322.3.332.3.42.3.4.12.3.72.3.8 |
2.3.34 |
org.apache.struts:struts2-rest-pluginMaven |
2.5.0 up to 2.5.13, plus listed versions 2.52.5.12.5.102.5.10.12.5.122.5.22.5.52.5.8 |
2.5.13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-9793 is a high vulnerability (CVSS 7.5) in Apache Struts, published September 20, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.79%, the 95th percentile. Fixed in org.apache.struts:struts2-rest-plugin 2.5.13.
References
oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
securitytracker.com/id/1039262
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2
brocade.com/content/dam/common/documents/content-types/security-bulletin/brocade-security-advisory-2017-429.htm
security.netapp.com/advisory/ntap-20180629-0001
struts.apache.org/docs/s2-051.html
securityfocus.com/bid/100611
nvd.nist.gov/vuln/detail/CVE-2017-9793
github.com/advisories/GHSA-vwxj-6m5m-rrvh