CVE-2017-9804
Apache Struts allows entering a custom URL in a form field if built-in URLValidator is used
CVE-2017-9804 is a high vulnerability (CVSS 7.5) in Apache Struts, published September 20, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.24%, the 94th percentile. Fixed in org.apache.struts:struts2-core 2.3.34.
In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.
- Record
CVE-2017-9804- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.
- Record
CVE-2017-9804- Updated
- 2026-11-02
EUVDEUVD-2018-0711 No score
In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.
- Record
EUVD-2018-0711- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x5x7-3v85-wpc4
Apache Struts allows entering a custom URL in a form field if built-in URLValidator is used
In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.
- Record
GHSA-x5x7-3v85-wpc4- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.
- Record
CVE-2017-9804- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-x5x7-3v85-wpc4
Apache Struts allows entering a custom URL in a form field if built-in URLValidator is used
In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.
- Record
GHSA-x5x7-3v85-wpc4- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts:struts2-coreMaven |
2.3.7 to 2.3.33 | 2.3.34 |
org.apache.struts:struts2-coreMaven |
2.5.0 to 2.5.12 | 2.5.13 |
org.apache.struts:struts2-coreMaven |
2.3.7 up to 2.3.34, plus listed versions 2.3.122.3.142.3.14.12.3.14.22.3.14.3 Show 22 moreShow less2.3.152.3.15.12.3.15.22.3.15.32.3.162.3.16.12.3.16.22.3.16.32.3.202.3.20.12.3.20.32.3.242.3.24.12.3.24.32.3.282.3.28.12.3.292.3.302.3.312.3.322.3.332.3.8 |
2.3.34 |
org.apache.struts:struts2-coreMaven |
2.5.0 up to 2.5.13, plus listed versions 2.52.5.12.5.102.5.10.12.5.122.5.22.5.52.5.8 |
2.5.13 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2
securityfocus.com/bid/100612
security.netapp.com/advisory/ntap-20180629-0001
arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt
securitytracker.com/id/1039261
Show 7 moreShow less
struts.apache.org/docs/s2-050.html
nvd.nist.gov/vuln/detail/CVE-2017-9804
github.com/apache/struts/commit/418a20c0594f23764fe29ced400c1219239899a
web.archive.org/web/20171113165852/http://www.securityfocus.com/bid/100612