GHSA-gg9m-fj3v-r58c

Source

https://github.com/advisories/GHSA-gg9m-fj3v-r58c

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-gg9m-fj3v-r58c/GHSA-gg9m-fj3v-r58c.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gg9m-fj3v-r58c

Aliases

CVE-2017-9805

Published

2018-10-16T19:37:56Z

Modified

2024-07-25T20:30:47.148804Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering

Details

The REST Plugin in Apache Struts 2.1.2 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

Database specific

{
    "nvd_published_at": "2017-09-15T19:29:00Z",
    "cwe_ids": [
        "CWE-502"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:37:16Z"
}

References

Affected packages

Maven / org.apache.struts:struts2-rest-plugin

Package

Name: org.apache.struts:struts2-rest-plugin; View open source insights on deps.dev
Purl: pkg:maven/org.apache.struts/struts2-rest-plugin

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.1.2

Fixed

2.3.34

Affected versions

2.*

2.1.2

2.1.6

2.1.8

2.1.8.1

2.2.1

2.2.1.1

2.2.3

2.2.3.1

2.3.1

2.3.1.1

2.3.1.2

2.3.3

2.3.4

2.3.4.1

2.3.7

2.3.8

2.3.12

2.3.14

2.3.14.1

2.3.14.2

2.3.14.3

2.3.15

2.3.15.1

2.3.15.2

2.3.15.3

2.3.16

2.3.16.1

2.3.16.2

2.3.16.3

2.3.20

2.3.20.1

2.3.20.3

2.3.24

2.3.24.1

2.3.24.3

2.3.28

2.3.28.1

2.3.29

2.3.30

2.3.31

2.3.32

2.3.33

Maven / org.apache.struts:struts2-rest-plugin

Package

Name: org.apache.struts:struts2-rest-plugin; View open source insights on deps.dev
Purl: pkg:maven/org.apache.struts/struts2-rest-plugin

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.5.0

Fixed

2.5.13

Affected versions

2.*

2.5

2.5.1

2.5.2

2.5.5

2.5.8

2.5.10

2.5.10.1

2.5.12