CVE-2017-9804 is a vulnerability in Apache Struts
Published on September 20, 2017
In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.
Products Associated with CVE-2017-9804
Want to know whenever a new CVE is published for Apache Struts? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Struts:- Version 2.3.7 - 2.3.33 is affected.
- Version 2.5 - 2.5.12 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.