{"basis":"claimed","id":"CVE-2017-9805","name":"Apache Struts Deserialization of Untrusted Data Vulnerability","vendorProject":"Apache","product":"Struts","publishedAt":"2017-09-15","cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"exploited":{"kevAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false},"epss":{"score":0.99396,"percentile":0.99941,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"no_history","firstOn":null,"daysToRule":null},"aws":{"status":"no_history","firstOn":null,"daysToRule":null},"azure":{"status":"rule","firstOn":null,"daysToRule":null},"google":{"status":"rule","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"no_history","firstOn":null,"daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"no_history","firstOn":null,"daysToRule":null}},"title":null,"description":"The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.","cwes":["CWE-502"],"vendors":[{"vendor":"cloudflare","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"rule","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[{"id":"25de48a55501aa0bf599ceecabdb200f04a1481000081f3174b18c465588828f","cve_id":"CVE-2017-9805","vendor":"azure","product":"Front Door WAF (DRS)","rule_id":"944110","rule_name":"Remote Command Execution: Java process spawn (CVE-2017-9805)","change":"listed","default_action":null,"published_on":null,"source_url":"https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-drs","source_title":"Front Door WAF (DRS) rule groups and rules","excerpt":"Rule 944110: Critical - 5 · 1 · Remote Command Execution: Java process spawn (CVE-2017-9805)","first_seen_at":"2026-11-02T21:00:19.031Z"},{"id":"d9336e6bdf2e94075d2acce481cebe50a460f3bcaf781a503a05146a9b7b71d1","cve_id":"CVE-2017-9805","vendor":"azure","product":"Application Gateway WAF (DRS/CRS)","rule_id":"944110","rule_name":"Remote Command Execution: Java process spawn (CVE-2017-9805)","change":"listed","default_action":null,"published_on":null,"source_url":"https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules","source_title":"Application Gateway WAF (DRS/CRS) rule groups and rules","excerpt":"Rule 944110: Critical - 5 · 1 · Remote Command Execution: Java process spawn (CVE-2017-9805)","first_seen_at":"2026-11-02T21:00:19.031Z"}]},{"vendor":"google","status":"rule","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[{"id":"496692c4909bf29a74329a0789155503fb6443029a022b3ee8efb87f7390efd3","cve_id":"CVE-2017-9805","vendor":"google","product":"Cloud Armor preconfigured rules","rule_id":"owasp-crs-v042200-id944110-java","rule_name":"Remote command execution: Java process spawn (CVE-2017-9805)","change":"listed","default_action":null,"published_on":null,"source_url":"https://docs.cloud.google.com/armor/docs/waf-rules","source_title":"Cloud Armor preconfigured WAF rules","excerpt":"Signature owasp-crs-v042200-id944110-java (sensitivity 1): Remote command execution: Java process spawn (CVE-2017-9805)","first_seen_at":"2026-11-02T21:00:21.696Z"},{"id":"c335803b1c67bfcca80ca4b93cc36af57fce4072418ae3a047176379de02caf2","cve_id":"CVE-2017-9805","vendor":"google","product":"Cloud Armor preconfigured rules","rule_id":"owasp-crs-v030301-id944110-java","rule_name":"Remote command execution: Java process spawn (CVE-2017-9805)","change":"listed","default_action":null,"published_on":null,"source_url":"https://docs.cloud.google.com/armor/docs/waf-rules","source_title":"Cloud Armor preconfigured WAF rules","excerpt":"Signature owasp-crs-v030301-id944110-java (sensitivity 1): Remote command execution: Java process spawn (CVE-2017-9805)","first_seen_at":"2026-11-02T21:00:21.696Z"}]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-03T00:17:43.949Z","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","ssvc":{"exploitation":"active","automatable":"no","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"blocked","templateId":"CVE-2017-9805","templatePath":"http/cves/2017/CVE-2017-9805.yaml","requests":2,"blockedRequests":2,"rules":["930120","932160","944100","944110","944130"],"note":"","requestDetail":[{"method":"POST","path":"/struts2-rest-showcase/orders/3","status":403,"blocked":true,"rules":["930120","932160","944100","944110","944130"]},{"method":"POST","path":"/orders/3","status":403,"blocked":true,"rules":["930120","932160","944100","944110","944130"]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"blocked","templateId":"CVE-2017-9805","templatePath":"http/cves/2017/CVE-2017-9805.yaml","requests":2,"blockedRequests":2,"rules":["930120","932160","932236","944100","944110","944130","944250"],"note":"","requestDetail":[{"method":"POST","path":"/struts2-rest-showcase/orders/3","status":403,"blocked":true,"rules":["930120","932160","932236","944100","944110","944130"]},{"method":"POST","path":"/orders/3","status":403,"blocked":true,"rules":["930120","932160","932236","944100","944110","944130"]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0},{"day":"2026-11-03","posts":0}],"top_posts":[],"exploit_repositories":[]}}