VYPR
← All advisories
Medium severity5.9NVD Advisory· Published Jul 13, 2017· Updated Jun 17, 2026

CVE-2017-7672

CVE-2017-7672

Description

If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.struts:struts2-coreMaven
>= 2.5.0, < 2.5.122.5.12

Affected products

9
  • Apache/Struts8 versions
    cpe:2.3:a:apache:struts:2.5:*:*:*:*:*:*:*+ 7 more
    • cpe:2.3:a:apache:struts:2.5:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:struts:2.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:struts:2.5.10:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:struts:2.5.10.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:struts:2.5.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:struts:2.5.5:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:struts:2.5.8:*:*:*:*:*:*:*
    • (no CPE)range: 2.5 to 2.5.10.1
  • ghsa-coords
    pkg:maven/org.apache.struts/struts2-core
    Range: >= 2.5.0, < 2.5.12

Patches

Vulnerability mechanics

References

12

News mentions

0

No linked articles in our index yet.