{"action":"Upgrade org.apache.struts:struts2-rest-plugin to 2.3.34 (2.3.x) or 2.5.13 (2.5.x) or later.","affected":[{"fixed":"2.3.34","introduced":"2.1.1"},{"fixed":"2.5.13","introduced":"2.5.0"}],"component":"org.apache.struts:struts2-rest-plugin","cve_ids":["CVE-2017-9805"],"ecosystem":"Maven","epss":0.99396,"exploited":true,"fixed_versions":["2.3.34","2.5.13"],"ghsa_id":"GHSA-gg9m-fj3v-r58c","id":"tcs_01M5N8Y7WQZ5QNNG827EC14JP9","modified_at":"2025-10-22T19:13:04.007003Z","published_at":"2018-10-16T19:37:56Z","references":["https://osv.dev/vulnerability/GHSA-gg9m-fj3v-r58c","https://nvd.nist.gov/vuln/detail/CVE-2017-9805","https://github.com/apache/struts/commit/19494718865f2fb7da5ea363de3822f87fbda26","https://github.com/apache/struts/commit/6dd6e5cfb7b5e020abffe7e8091bd63fe97c10a","https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax","https://bugzilla.redhat.com/show_bug.cgi?id=1488482","https://cwiki.apache.org/confluence/display/WW/S2-052","https://github.com/apache/struts","https://lgtm.com/blog/apache_struts_CVE-2017-9805","https://security.netapp.com/advisory/ntap-20170907-0001","https://struts.apache.org/docs/s2-052.html","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2","https://web.archive.org/web/20170909031344/http://www.securityfocus.com/bid/100609","https://web.archive.org/web/20170922053119/http://www.securitytracker.com/id/1039263","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9805","https://www.exploit-db.com/exploits/42627","https://www.kb.cert.org/vuls/id/112992","http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html","http://www.securityfocus.com/bid/100609","http://www.securitytracker.com/id/1039263"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-gg9m-fj3v-r58c","url":"https://osv.dev/vulnerability/GHSA-gg9m-fj3v-r58c"},{"source":"kev","source_id":"CVE-2017-9805","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}],"summary":"REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering"}