Overview
- Description
- The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
- Source
- security@apache.org
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 8.1
- Impact score
- 5.9
- Exploitability score
- 2.2
- Vector string
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 6.8
- Impact score
- 6.4
- Exploitability score
- 8.6
- Vector string
- AV:N/AC:M/Au:N/C:P/I:P/A:P
Known exploits
Data from CISA
- Vulnerability name
- Apache Struts Deserialization of Untrusted Data Vulnerability
- Exploit added on
- Nov 3, 2021
- Exploit action due
- May 3, 2022
- Required action
- Apply updates per vendor instructions.
Weaknesses
- nvd@nist.gov
- CWE-502
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "13744BE3-2443-4640-BDB4-722C4D393B65",
"versionEndExcluding": "2.3.34",
"versionStartIncluding": "2.1.2"
},
{
"criteria": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6B45E858-E783-4D6E-AFD3-97E9963EB05B",
"versionEndExcluding": "2.5.13",
"versionStartIncluding": "2.5.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:digital_media_manager:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E0B1E953-33EF-498D-AB75-4A0A7733BC54"
},
{
"criteria": "cpe:2.3:a:cisco:hosted_collaboration_solution:10.5\\(1\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CF4C9089-0F27-4C66-8E12-2BCAC148B7C9"
},
{
"criteria": "cpe:2.3:a:cisco:hosted_collaboration_solution:11.0\\(1\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7FCC3E9D-4D39-4530-A5FC-7E9A4E395D60"
},
{
"criteria": "cpe:2.3:a:cisco:hosted_collaboration_solution:11.5\\(1\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F972A2A1-3002-4086-8FA2-F231D4ED0B00"
},
{
"criteria": "cpe:2.3:a:cisco:hosted_collaboration_solution:11.6\\(1\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D52C5D91-33D1-4C90-BEC9-90D955AA5883"
},
{
"criteria": "cpe:2.3:a:cisco:media_experience_engine:3.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "93C3A3B2-B346-47F4-B987-0098AB95F939"
},
{
"criteria": "cpe:2.3:a:cisco:media_experience_engine:3.5.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "87CCEC7F-058D-4202-88B3-F06372DFFA99"
},
{
"criteria": "cpe:2.3:a:cisco:network_performance_analysis:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "76D400A4-9918-494E-89B7-EAA57B2830D2"
},
{
"criteria": "cpe:2.3:a:cisco:video_distribution_suite_for_internet_streaming:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "912F9C5E-AA5F-4746-AC49-D33C2495C73B"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7DCBCC5D-C396-47A8-ADF4-D3A2C4377FB1"
}
],
"operator": "OR"
}
]
}
]