{"action":"Upgrade org.apache.struts:struts2-core to 2.3.34 (2.3.x) or 2.5.13 (2.5.x) or later.","affected":[{"fixed":"2.3.34","introduced":"2.3.7"},{"fixed":"2.5.13","introduced":"2.5.0"}],"component":"org.apache.struts:struts2-core","cve_ids":["CVE-2017-9804"],"ecosystem":"Maven","epss":0.08237,"exploited":false,"fixed_versions":["2.3.34","2.5.13"],"ghsa_id":"GHSA-x5x7-3v85-wpc4","id":"tcs_01M5N9HTA2ZBY5F0AY3XAZ8C48","modified_at":"2024-02-19T05:32:27.835005Z","published_at":"2018-10-16T19:37:33Z","references":["https://osv.dev/vulnerability/GHSA-x5x7-3v85-wpc4","https://nvd.nist.gov/vuln/detail/CVE-2017-9804","https://github.com/apache/struts/commit/418a20c0594f23764fe29ced400c1219239899a","https://github.com/apache/struts","https://security.netapp.com/advisory/ntap-20180629-0001","https://struts.apache.org/docs/s2-050.html","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2","https://web.archive.org/web/20171113165852/http://www.securityfocus.com/bid/100612","https://web.archive.org/web/20201021075553/http://www.securitytracker.com/id/1039261","http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt","http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-x5x7-3v85-wpc4","url":"https://osv.dev/vulnerability/GHSA-x5x7-3v85-wpc4"}],"summary":"Apache Struts allows entering a custom URL in a form field if built-in URLValidator is used"}