VYPR
High severity8.1CISA KEVNVD Advisory· Published Sep 15, 2017· Updated Jun 17, 2026

CVE-2017-9805

CVE-2017-9805

Description

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.struts:struts2-rest-pluginMaven
>= 2.1.1, < 2.3.342.3.34
org.apache.struts:struts2-rest-pluginMaven
>= 2.5.0, < 2.5.132.5.13

Affected products

12

Patches

Vulnerability mechanics

References

21

News mentions

0

No linked articles in our index yet.