{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-04T01:01:21.386","vulnerabilities":[{"cve":{"id":"CVE-2017-9791","sourceIdentifier":"security@apache.org","published":"2017-07-10T16:29:00.277","lastModified":"2026-04-21T16:59:33.267","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage."},{"lang":"es","value":"El plugin Struts 1 en Apache Struts versiones 2.1.x y 2.3.x, podría permitir la ejecución de código remota por medio de un valor de campo malicioso pasado en un mensaje sin procesar en la ActionMessage."}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"cisaExploitAdd":"2022-02-10","cisaActionDue":"2022-08-10","cisaRequiredAction":"Apply updates per vendor instructions.","cisaVulnerabilityName":"Apache Struts 1 Improper Input Validation Vulnerability","weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:*","matchCriteriaId":"4E3316DA-9E34-4955-91CA-E35B141A7007"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*","matchCriteriaId":"0D152B29-FAD5-4DEA-B187-278EBD37FEB4"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*","matchCriteriaId":"2AC68463-F500-471C-8600-8F8FD9743B12"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*","matchCriteriaId":"A92AAE08-4811-465A-8178-25F5F349B8BA"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*","matchCriteriaId":"B487975D-6394-4136-B45C-C1F209465B24"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:*","matchCriteriaId":"BDC41957-8CCA-46A6-BD31-4039EEF3C457"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:*","matchCriteriaId":"443B4E64-2A36-49C6-B09D-77B3BDF69709"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:*","matchCriteriaId":"2481505C-4FD1-4195-9E10-9DD741498FB2"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:*","matchCriteriaId":"28ED63DB-2AAF-4BC9-A844-074EDF63C89A"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:*","matchCriteriaId":"38A6CEED-6C43-4325-B36C-9F254CCDFDC0"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:*","matchCriteriaId":"41F43088-26AA-4890-A9D6-1B9B48D5F02A"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:*","matchCriteriaId":"BE6820E3-8FDF-4BDF-8B62-E604A91F1280"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:*","matchCriteriaId":"D25ED06A-F12C-443E-9B3F-FDDF52FE9D93"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:*","matchCriteriaId":"44527919-8403-42A8-9CE1-3B4F58630F34"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:*","matchCriteriaId":"EBB91D8A-14B8-4263-B90D-F776535F9B8F"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:*","matchCriteriaId":"FB525941-7175-43C1-9F17-814F5F7C72CA"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:*","matchCriteriaId":"F10D559E-04A0-4002-947C-D3902138795B"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:*","matchCriteriaId":"89203DD8-2C95-4546-9504-83654FFA5DBC"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:*","matchCriteriaId":"EB3D5644-CFAC-4FB5-A1FB-387F97876098"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:*","matchCriteriaId":"1225A0B0-C3F2-4579-BFE9-F8DB2CF596F6"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:*","matchCriteriaId":"8DC883A7-0766-4857-ABC8-9DB4BA713650"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:*","matchCriteriaId":"22FF6282-0BCA-46EB-9648-6EE3EDA189F2"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:*","matchCriteriaId":"6D1467BC-9BC8-402D-A420-615CF9698648"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.20.3:*:*:*:*:*:*:*","matchCriteriaId":"880AEA69-3705-447D-80FF-60753248158F"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:*","matchCriteriaId":"524C5119-416D-413B-BF1D-29291E23FDB2"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:*","matchCriteriaId":"45446B16-F531-4C6D-B889-A8A6622C70A2"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:*","matchCriteriaId":"71823E13-1896-4EE4-A49C-CFFB717FFD80"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:*","matchCriteriaId":"C778ADED-75B5-4AD3-8CDC-EFDFFAD5A742"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:*","matchCriteriaId":"067F6249-CC5A-4402-843C-06D5F9F77267"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:*","matchCriteriaId":"0AFA78DD-B60C-46AD-BCCB-4E15BB16BEDC"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:*","matchCriteriaId":"1DA1EABE-5292-44C2-8327-54201A42F204"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.31:*:*:*:*:*:*:*","matchCriteriaId":"F327A6EA-69AF-4EB2-8F17-8011678FAB6D"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.3.32:*:*:*:*:*:*:*","matchCriteriaId":"603FAA0C-0908-4105-BE3A-016B4A298264"}]}]}],"references":[{"url":"http://struts.apache.org/docs/s2-048.html","source":"security@apache.org","tags":["Mitigation","Vendor Advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html","source":"security@apache.org","tags":["Patch","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/99484","source":"security@apache.org","tags":["Third Party Advisory","VDB Entry","Broken Link"]},{"url":"http://www.securitytracker.com/id/1038838","source":"security@apache.org","tags":["Third Party Advisory","VDB Entry","Broken Link"]},{"url":"https://security.netapp.com/advisory/ntap-20180706-0002/","source":"security@apache.org","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/42324/","source":"security@apache.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/44643/","source":"security@apache.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://struts.apache.org/docs/s2-048.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Vendor Advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/99484","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry","Broken Link"]},{"url":"http://www.securitytracker.com/id/1038838","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry","Broken Link"]},{"url":"https://security.netapp.com/advisory/ntap-20180706-0002/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/42324/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/44643/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9791","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}]}}]}