CVE-2017-15707

MEDIUM

Apache Struts 2.5-2.5.14 - Denial of Service via Malicious JSON Payload

Title source: llm
STIX 2.1

Description

In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.

References (6)

Core 6
Core References
Patch, Vendor Advisory x_refsource_confirm
https://cwiki.apache.org/confluence/display/WW/S2-054
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1039946
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/102021
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20171214-0001/

Scores

CVSS v3 6.2
EPSS 0.0153
EPSS Percentile 81.6%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-20
Status published
Products (22)
apache/struts 2.5 - 2.5.14
Apache Software Foundation/Apache Struts 2.5 to 2.5.14
netapp/oncommand_balance
oracle/agile_plm_framework 9.3.6
oracle/enterprise_manager_for_virtualization 13.2.2
oracle/enterprise_manager_for_virtualization 13.2.3
oracle/financial_services_hedge_management_and_ifrs_valuations 8.0.4
oracle/financial_services_hedge_management_and_ifrs_valuations 8.0.5
oracle/financial_services_market_risk_measurement_and_management 8.0.5
oracle/global_lifecycle_management_opatchauto
... and 12 more
Published Dec 01, 2017
Tracked Since Feb 18, 2026