High severity7.5NVD Advisory· Published Sep 20, 2017· Updated May 13, 2026
CVE-2017-9804
CVE-2017-9804
Description
In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.struts:struts2-coreMaven | >= 2.3.7, < 2.3.34 | 2.3.34 |
org.apache.struts:struts2-coreMaven | >= 2.5.0, < 2.5.13 | 2.5.13 |
Affected products
56cpe:2.3:a:apache:struts:2.3.31:*:*:*:*:*:*:*+ 54 more
- cpe:2.3:a:apache:struts:2.3.31:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.32:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.33:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.5:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.5:beta2:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.5:beta3:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.5.6:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.5.7:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.5.8:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.5.9:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.5.10:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.5.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.5.12:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.9:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.10:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.11:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.13:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.17:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.19:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.20.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.21:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.22:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.23:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.24.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.25:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.26:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.27:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:2.5:beta1:*:*:*:*:*:*
- Apache Software Foundation/Apache Strutsv5Range: 2.3.7 - 2.3.33
Patches
1418a20c0594fhttps://github.com/apache/strutsvia ghsa
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
13- www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.htmlnvdPatchThird Party AdvisoryWEB
- struts.apache.org/docs/s2-050.htmlnvdPatchVendor AdvisoryWEB
- www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txtnvdThird Party AdvisoryWEB
- www.securityfocus.com/bid/100612nvdThird Party AdvisoryVDB Entry
- www.securitytracker.com/id/1039261nvdThird Party AdvisoryVDB Entry
- github.com/advisories/GHSA-x5x7-3v85-wpc4ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2017-9804ghsaADVISORY
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2nvdThird Party AdvisoryWEB
- github.com/apache/struts/commit/418a20c0594f23764fe29ced400c1219239899aghsaWEB
- security.netapp.com/advisory/ntap-20180629-0001ghsaWEB
- web.archive.org/web/20171113165852/http://www.securityfocus.com/bid/100612ghsaWEB
- web.archive.org/web/20201021075553/http://www.securitytracker.com/id/1039261ghsaWEB
- security.netapp.com/advisory/ntap-20180629-0001/nvd
News mentions
0No linked articles in our index yet.