Main
Vulnerability Database
Exploits
ID:1258 - Exploit for Remote code execution in Apache Struts - CVE-2017-9791
ID:1258 - Exploit for Remote code execution in Apache Struts - CVE-2017-9791
Published: March 18, 2020
Vulnerability identifier: #VU7391
Vulnerability risk: High
CVE-ID: CVE-2017-9791
CWE-ID: CWE-20
Exploitation vector: Remote access
Vulnerable software:
Apache Struts
Apache Struts
Link to public exploit:
Vulnerability description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to input validation error when using the Struts 2 Struts 1 plugin and it's a Struts 1 action. A remote attacker can send an error message in the
Successful exploitation of the vulnerability may result in system compromise.
The weakness exists due to input validation error when using the Struts 2 Struts 1 plugin and it's a Struts 1 action. A remote attacker can send an error message in the
ActionMessage class containing malicious field value and execute arbitrary code on the target system.Successful exploitation of the vulnerability may result in system compromise.
Remediation
Follow vendor's recommendations to mitigate this vulnerability.