What is the CVSS score of CVE-2017-9805?

CVE-2017-9805 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 94.3%.

Is there a public PoC exploit available for CVE-2017-9805?

Yes, a public proof-of-concept exploit is available for CVE-2017-9805. Prioritise patching immediately. EPSS: 94.3%.

Is there a patch available for CVE-2017-9805?

Yes, a patch is available for CVE-2017-9805. Update the affected software to the latest version immediately.

Struts CVE-2017-9805

HIGH

Deserialization of Untrusted Data (CWE-502)

2017-09-15 security@apache.org

RCE Apache Deserialization Cisco Struts Oncommand Balance Digital Media Manager Hosted Collaboration Solution Media Experience Engine Network Performance Analysis Video Distribution Suite For Internet Streaming Netapp

8.1

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-502 OWASP Top 10:2025 A08:2025 - Software or Data Integrity Failures ASVS 5.0 V1 - Encoding and Sanitization Safe deserialization, type allowlists MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS score of 8.1 (HIGH). Attack characteristics: network attack vector, high complexity, no privileges required, no user interaction not required. CISA has confirmed active exploitation in the wild. Public proof-of-concept exploit code is available. EPSS exploitation probability: 94.32%.
Exploit ScenarioDerived	A remote attacker could execute arbitrary code through malicious serialized objects by sending crafted requests to the affected application. No authentication is required to exploit this vulnerability.

Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.

Exploited in the wild (CISA KEV) Patch available 94.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Avoid deserializing untrusted data. Use safe serialization formats (JSON). Implement integrity checks and type allowlists.

Affected Packages

maven org.apache.struts:struts2-rest-plugin fix: 2.3.34, 2.5.13

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in maven

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability is classified as Deserialization of Untrusted Data (CWE-502), which allows attackers to execute arbitrary code through malicious serialized objects. The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads. Affected products include: Apache Struts, Cisco Digital Media Manager, Cisco Hosted Collaboration Solution, Cisco Media Experience Engine, Cisco Network Performance Analysis. Version information: through 2.3..

Know when Struts gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Apr 21, 2026 - 15:31 CISA

CVE Published

Sep 15, 2017 - 19:29 cve.org

HIGH 8.1

DescriptionCVE.org

Threat Intelligence Overview

Threat Score

7.4/10

Composite threat intelligence

EPSS Score

94.3%

Top 0% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

NVD

CVE.org

CISA KEV

EPSS POC (2)

Exploit-DB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV Yes

Public POC Yes

EPSS 94.3%

Patch available Yes

Active threat Yes

Deciding rule

In CISA KEV with patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Active

System Exposure· derived

Open

Automatable· derived

Human Impact· derived

High

Priority Score

219

Low Medium High Critical

KEV: +50

EPSS: +94

CVSS: +40

PoC: +20

Weaponized: +15

Threat intel: 0

Gov advisory: 0

Attack Technique

Insecure Deserialization CRITICAL

Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)CVE.org

cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*

cpe:2.3:a:cisco:digital_media_manager:-:*:*:*:*:*:*:*

cpe:2.3:a:cisco:hosted_collaboration_solution:10.5\(1\):*:*:*:*:*:*:*

cpe:2.3:a:cisco:hosted_collaboration_solution:11.0\(1\):*:*:*:*:*:*:*

cpe:2.3:a:cisco:hosted_collaboration_solution:11.5\(1\):*:*:*:*:*:*:*

cpe:2.3:a:cisco:hosted_collaboration_solution:11.6\(1\):*:*:*:*:*:*:*

cpe:2.3:a:cisco:media_experience_engine:3.5:*:*:*:*:*:*:*

cpe:2.3:a:cisco:media_experience_engine:3.5.2:*:*:*:*:*:*:*

cpe:2.3:a:cisco:network_performance_analysis:-:*:*:*:*:*:*:*

cpe:2.3:a:cisco:video_distribution_suite_for_internet_streaming:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*

More in Struts

View all

CVE-2016-3081 HIGH Act Now POC

8.1 Apr 26

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, a

CVE-2013-2251 CRITICAL Act Now POC

9.8 Jul 20

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a

CVE-2017-5638 CRITICAL Act Now POC

9.8 Mar 11

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha

CVE-2013-1966 CRITICAL Act Now POC

9.3 Jul 10

Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not

CVE-2016-3087 CRITICAL Act Now POC

9.8 Jun 07

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, a

CVE-2014-0114 HIGH Act Now POC

7.5 Apr 30

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in o

CVE-2014-0112 HIGH Act Now POC

7.5 Apr 29

ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which all

CVE-2017-12611 CRITICAL Act Now POC

9.8 Sep 20

In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag in

CVE-2013-2115 HIGH Act Now POC

8.1 Jul 10

Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not

CVE-2012-0394 MEDIUM This Month POC

6.8 Jan 08

The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers

CVE-2013-1965 CRITICAL Act Now POC

9.3 Jul 10

Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute

CVE-2013-2134 CRITICAL Act Now POC

9.3 Jul 16

Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted acti

Same weakness CWE-502 – Deserialization of Untrusted Data

View all

CVE-2021-35464 CRITICAL POC

9.8

CVE-2020-10189 CRITICAL POC

9.8

CVE-2019-18935 CRITICAL POC

9.8

CVE-2015-7450 CRITICAL POC

9.8

CVE-2025-53770 CRITICAL POC

9.8

CVE-2020-7961 CRITICAL POC

9.8

CVE-2021-42237 CRITICAL POC

9.8

CVE-2025-24016 CRITICAL POC

9.9

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2017-7269 CRITICAL POC

9.8

CVE-2022-47966 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2023-3519 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

References

Advisories & patches

PATCH http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html ADVISORY https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax ADVISORY https://cwiki.apache.org/confluence/display/WW/S2-052 ADVISORY https://struts.apache.org/docs/s2-052.html REF http://www.securityfocus.com/bid/100609 REF http://www.securitytracker.com/id/1039263 REF https://bugzilla.redhat.com/show_bug.cgi?id=1488482 REF https://lgtm.com/blog/apache_struts_CVE-2017-9805 REF https://security.netapp.com/advisory/ntap-20170907-0001/ REF https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2 REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9805 REF https://www.kb.cert.org/vuls/id/112992

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back