Not rated
CVE-2017-9804 In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field…
Description
In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Struts | Versions not published |
References
- www.oracle.com www.oracle.com
- 20170907 Multiple Vulnerabilities in Apache Struts 2 Affecting Cisco Products: September 2017 tools.cisco.com
- 100612 www.securityfocus.com
- security.netapp.com security.netapp.com
- www.arubanetworks.com www.arubanetworks.com
- 1039261 www.securitytracker.com
- struts.apache.org struts.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Struts
The 33 CVEs of Apache Struts →
CVE-2026-104714
Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache…
Not rated
CVE-2026-104713
Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin
Not rated
CVE-2026-104712
Asymmetric resource consumption (amplification) vulnerability in Apache Struts
Not rated
CVE-2026-104711
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection')…
Not rated