Servers and applications
CVE-2017-9793 The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.
Severity High 7.5
Published 20 Sept 2017
Last changed 17 Jun 2026
Added to UpHeron 1 Nov 2026 Exploit chance 8.8% in the next 30 daysHigher than 95% of CVEs. EPSS by FIRST , 11 Nov 2026
Attack Over the network · No login needed · No user action needed
Attacker can Take it down
CVSS vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Sources NVD Affected software Software Affected versions Apache StrutsServers and applications · cpe:a:apache:struts Version 2.5.12 Version 2.5.10.1 Version 2.5.10 Version 2.5.9 All 55 release lines Version 2.3.7 Version 2.3.8 Version 2.3.9 Version 2.3.10 Version 2.3.11 Version 2.3.12 Version 2.3.13 Version 2.3.14 Version 2.3.14.1 Version 2.3.14.2 Version 2.3.14.3 Version 2.3.15 Version 2.3.15.1 Version 2.3.15.2 Version 2.3.15.3 Version 2.3.16 Version 2.3.16.1 Version 2.3.16.2 Version 2.3.16.3 Version 2.3.17 Version 2.3.19 Version 2.3.20 Version 2.3.20.1 Version 2.3.20.2 Version 2.3.21 Version 2.3.22 Version 2.3.23 Version 2.3.24.2 Version 2.3.24.3 Version 2.3.25 Version 2.3.26 Version 2.3.27 Version 2.3.28 Version 2.3.28.1 Version 2.3.29 Version 2.3.30 Version 2.3.31 Version 2.3.32 Version 2.3.33 Version 2.5-beta1 Version 2.5-beta2 Version 2.5-beta3 Version 2.5 Version 2.5.1 Version 2.5.2 Version 2.5.3 Version 2.5.4 Version 2.5.5 Version 2.5.6 Version 2.5.7 Version 2.5.8 Version 2.5.9 Version 2.5.10 Version 2.5.10.1 Version 2.5.12
References NVD https://nvd.nist.gov/vuln/detail/CVE-2017-9793 CVE.org https://www.cve.org/CVERecord?id=CVE-2017-9793