CVE-2017-15707
Quick assessment
Affected
Apache Software Foundation Apache Struts
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Struts是美国阿帕奇（Apache）软件基金会负责维护的一个开源项目，是一套用于创建企业级Java Web应用的开源MVC框架。Apache Struts 2是Apache Struts的下一代产品，是在Struts 1和WebWork的技术基础上进行了合并的全新Struts 2框架。 Apache Struts 2.5版本至2.5.14版本中存在安全漏洞。在使用Struts REST插件时，攻击者可通过发送特制的JSON请求利用该漏洞造成拒绝服务。
Possible ATT&CK Techniques 1 AI
T1021 · Remote Services
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2017-15707
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Struts 2 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Struts是美国阿帕奇（Apache）软件基金会负责维护的一个开源项目，是一套用于创建企业级Java Web应用的开源MVC框架。Apache Struts 2是Apache Struts的下一代产品，是在Struts 1和WebWork的技术基础上进行了合并的全新Struts 2框架。 Apache Struts 2.5版本至2.5.14版本中存在安全漏洞。在使用Struts REST插件时，攻击者可通过发送特制的JSON请求利用该漏洞造成拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Struts | 2.5 to 2.5.14 | - |
|
II. Public POCs for CVE-2017-15707
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2017-15707
请登录查看更多情报信息。
Vendor Advisories for CVE-2017-15707 (5)
-
https://security.netapp.com/advisory/ntap-20171214-0001/ x_refsource_CONFIRM
-
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html x_refsource_CONFIRM
-
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html x_refsource_CONFIRM
-
-
Other References for CVE-2017-15707 (1)
-
https://cwiki.apache.org/confluence/display/WW/S2-054 x_refsource_CONFIRM
Same Patch Batch · Apache Software Foundation · 2017-12-01 · 3 CVEs total
| CVE-2017-15701 | Apache Qpid Broker-J 安全漏洞 | |
| CVE-2017-15702 | Apache Qpid Broker-J 安全漏洞 |
IV. Related Vulnerabilities
Same product: Apache Struts
-
CVE-2026-104714
Apache Struts: Shared message formatter exposes date and tim -
CVE-2026-104713
Apache Struts: Unbounded request body read in the REST plugi -
CVE-2026-104712
Apache Struts: Disproportionate response size when rendering -
CVE-2026-104711
Apache Struts: OGNL injection in the legacy RESTful action m -
CVE-2026-73632
Apache Struts: Shared serialization state in the JSON plugin
Same vendor: Apache Software Foundation
-
CVE-2026-113582
Apache Abdera: XML external entity expansion in Atom documen -
CVE-2026-103634
Apache DataSketches: datasketches-cpp: Out-of-bounds read an -
CVE-2026-112381
Apache Traffic Server: Nullptr dereference in net_write_io o -
CVE-2026-111817
Apache Traffic Server: Dropping chunked trailers stalls a pa -
CVE-2026-111812
Apache Traffic Server: origin_server_auth signs client-contr
V. Comments for CVE-2017-15707
No comments yet