« Volver al listado

CVE-2017-7672

Estado: ModificadaMedia (5.9)—

If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Struts

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-7672",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Struts",
          "versions": [
            {
              "status": "affected",
              "version": "2.5 to 2.5.10.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-07-13T15:29:00.363",
  "references": [
    {
      "url": "http://struts.apache.org/docs/s2-047.html",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html",
      "source": "security@apache.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/99563",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1039114",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/3795c4dd46d9ec75f4a6eb9eca11c11edd3e796c6c1fd7b17b5dc50d%40%3Cannouncements.struts.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20180706-0002/",
      "source": "security@apache.org"
    },
    {
      "url": "http://struts.apache.org/docs/s2-047.html",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/99563",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1039114",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/3795c4dd46d9ec75f4a6eb9eca11c11edd3e796c6c1fd7b17b5dc50d%40%3Cannouncements.struts.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20180706-0002/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12."
    },
    {
      "lang": "es",
      "value": "Si una aplicación permite la introducción de una URL en un campo de un formulario y se emplea URLValidator (integrado), es posible preparar una URL especial que será utilizada para sobrecargar el proceso del servidor cuando se lleva a cabo la validación de la URL. La solución es actualizar a la versión 2.5.12 de Apache Struts."
    }
  ],
  "lastModified": "2026-06-17T01:24:56.840",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:struts:2.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63CE1226-E0E6-4DC6-AC89-3FFDE6BD7B77"
            },
            {
              "criteria": "cpe:2.3:a:apache:struts:2.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A4F914BA-CF16-4B03-A6A2-8C9816EC1248"
            },
            {
              "criteria": "cpe:2.3:a:apache:struts:2.5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D2C82970-62C9-4513-A66D-6BDA4048C27F"
            },
            {
              "criteria": "cpe:2.3:a:apache:struts:2.5.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D284BF2-101C-490C-85CB-69D156D1FF77"
            },
            {
              "criteria": "cpe:2.3:a:apache:struts:2.5.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "96C720D6-312B-477C-A993-BEE39A7ADB4E"
            },
            {
              "criteria": "cpe:2.3:a:apache:struts:2.5.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CF635DCE-D495-4166-9E25-1E48DDDF9AAC"
            },
            {
              "criteria": "cpe:2.3:a:apache:struts:2.5.10.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "725DBE04-720B-421E-B76A-4EE92FEE171C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}