Live › vulnerability › CVE-2017-9805
Go to dashboardApache Struts' REST Plugin deserializes XML with XStream without type filtering, so a crafted XML request can trigger deserialization of attacker-chosen objects. An unauthenticated remote attacker can run code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Apache Struts | vendor | – | – |
Check whether the struts2-rest-plugin jar is in the app's WEB-INF/lib or dependency tree and whether the app uses REST/XML handling.
Upgrade Apache Struts to a fixed release per the vendor advisory, or remove the REST plugin if unused.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
This page as .md · .json · in your agent: get_signal("CVE-2017-9805")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.