The Struts 1 plugin in Apache Struts 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
The MITRE CVE dictionary describes this issue as:
Find out more about CVE-2017-9791 from the MITRE CVE dictionary dictionary and NIST NVD.
This issue is present in a Struts 1 plugin for Apache Struts 2.3.x. It is not present in Apache Struts 1. This issue did not affect any of the Red Hat products as they did not include the Apache Struts 2 package.
NOTE: The following CVSS v3 metrics and score provided are preliminary and subject to review.
| CVSS3 Base Score | 8.1 |
|---|---|
| CVSS3 Base Metrics | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Attack Vector | Network |
| Attack Complexity | High |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity Impact | High |
| Availability Impact | High |
| Platform | Package | State |
|---|---|---|
| Red Hat JBoss Fuse Service Works 6 | struts2-core | Not affected |
Vulmon