Every CVE Search/ Get API key

CVE-2017-9805

REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering

8.1 HighIn KEVPublic exploitFix available

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

99.4%Up 13.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.1

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

Record
CVE-2017-9805
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-502
Updated
2026-11-02
CVE List 8.1

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

Record
CVE-2017-9805
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
EUVDEUVD-2018-0602 8.1

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

Record
EUVD-2018-0602
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-gg9m-fj3v-r58c 8.1

REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

Record
GHSA-gg9m-fj3v-r58c
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-502
Updated
2026-11-02
CISA KEV No score

Apache Struts Deserialization of Untrusted Data Vulnerability

Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.

Record
CVE-2017-9805
Weakness
CWE-502
Updated
2026-11-02
OSV 8.1

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

Record
CVE-2017-9805
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-gg9m-fj3v-r58c 8.1

REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

Record
GHSA-gg9m-fj3v-r58c
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-502
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.struts:struts2-rest-plugin
Maven
 2.5.0 up to 2.5.13
2.5.13
org.apache.struts:struts2-rest-plugin
Maven
 2.1.1 up to 2.3.34
2.3.34
org.apache.struts:struts2-rest-plugin
Maven
 2.1.1 up to 2.3.34, plus listed versions
2.1.22.1.62.1.82.1.8.12.2.1
Show 37 moreShow less
2.2.1.12.2.32.2.3.12.3.12.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.15.22.3.15.32.3.162.3.16.12.3.16.22.3.16.32.3.202.3.20.12.3.20.32.3.242.3.24.12.3.24.32.3.282.3.28.12.3.292.3.32.3.302.3.312.3.322.3.332.3.42.3.4.12.3.72.3.8
2.3.34
org.apache.struts:struts2-rest-plugin
Maven
 2.5.0 up to 2.5.13, plus listed versions
2.52.5.12.5.102.5.10.12.5.122.5.22.5.52.5.8
2.5.13

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitApache Struts 2 REST Plugin XStream RCE2017-09-05
Exploit-DBApache Struts 2.5 < 2.5.12 - REST Plugin XStream Remote Code Execution2017-09-06
PoC in GitHubluc10/struts-rce-cve-2017-98052017-09-06
PoC in GitHubhahwul/struts2-rce-cve-2017-9805-ruby2017-09-07
PoC in GitHubmazen160/struts-pwn_CVE-2017-98052017-09-09
PoC in GitHubLone-Ranger/apache-struts-pwn_CVE-2017-98052017-09-10
PoC in GitHub0x00-0x00/-CVE-2017-98052017-11-24
PoC in GitHubBeyondCy/S2-0522017-11-28
PoC in GitHubchrisjd20/cve-2017-9805.py2017-12-04
PoC in GitHubUbuntuStrike/struts_rest_rce_fuzz-CVE-2017-9805-2019-08-31
Show 13 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubUbuntuStrike/CVE-2017-9805-Apache-Struts-Fuzz-N-Sploit2019-09-02
PoC in GitHubAvishkaSenadheera/CVE-2017-9805---Documentation---IT191433782020-05-12
PoC in GitHubwifido/CVE-2017-9805-Exploit2020-06-11
PoC in GitHubrvermeulen/apache-struts-cve-2017-98052020-11-13
PoC in GitHubjongmartinez/-CVE-2017-9805-2020-11-28
PoC in GitHubz3bd/CVE-2017-98052021-03-05
PoC in GitHubagent3137/CVE-2017-9805-Exploit2021-04-04
PoC in GitHubShakun8/CVE-2017-98052022-10-03
PoC in GitHubNoSpaceAvailable/CVE-2017-9805_example_build2025-12-13
PoC in GitHubFl5xia/CVE-2017-98052026-01-04
PoC in GitHub7s26simon/CVE-2017-9805-S2-0522026-02-28
PoC in GitHubExperience-rookie/struts-s2-052-deserialization-rce-lab2026-03-16
NucleiApache Struts2 S2-052 - Remote Code Execution

History

History
RecordedChangedSources
exploitation, exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-9805 is a high vulnerability (CVSS 8.1) in Apache Struts, published September 15, 2017. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.4%, the 99th percentile. Fixed in org.apache.struts:struts2-rest-plugin 2.5.13.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open