CVE-2017-7672
Quick assessment
Affected
Apache Software Foundation Apache Struts
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Struts是美国阿帕奇（Apache）软件基金会负责维护的一个开源项目，是一套用于创建企业级Java Web应用的开源MVC框架，主要提供两个版本框架产品，Struts 1和Struts 2。Apache Struts 2是Apache Struts的下一代产品，是在Struts 1和WebWork的技术基础上进行了合并的全新Struts 2框架，其体系结构与Struts 1差别较大。 Apache Struts 2.5版本至2.5.10版本中存在安全漏洞。攻击者可利用该漏洞造成服务器进程
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2017-7672
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Struts 2 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Struts是美国阿帕奇（Apache）软件基金会负责维护的一个开源项目，是一套用于创建企业级Java Web应用的开源MVC框架，主要提供两个版本框架产品，Struts 1和Struts 2。Apache Struts 2是Apache Struts的下一代产品，是在Struts 1和WebWork的技术基础上进行了合并的全新Struts 2框架，其体系结构与Struts 1差别较大。 Apache Struts 2.5版本至2.5.10版本中存在安全漏洞。攻击者可利用该漏洞造成服务器进程
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Struts | 2.5 to 2.5.10.1 | - |
|
II. Public POCs for CVE-2017-7672
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2017-7672
请登录查看更多情报信息。
Vendor Advisories for CVE-2017-7672 (3)
Mailing List Discussions for CVE-2017-7672 (1)
Other References for CVE-2017-7672 (1)
-
http://struts.apache.org/docs/s2-047.html x_refsource_CONFIRM
Same Patch Batch · Apache Software Foundation · 2017-07-13 · 4 CVEs total
| CVE-2017-9787 | Apache Struts 2 安全漏洞 | |
| CVE-2017-9788 | Apache httpd 安全漏洞 | |
| CVE-2017-9789 | Apache httpd 安全漏洞 |
IV. Related Vulnerabilities
Same product: Apache Struts
-
CVE-2026-73632
Apache Struts: Shared serialization state in the JSON plugin -
CVE-2026-73631
Apache Struts: Shared parsing state in the JSON plugin -
CVE-2026-73635
Apache Struts: Unbounded growth of localized-text caches dri -
CVE-2026-73634
Apache Struts: Unbounded read of a Content Security Policy v -
CVE-2026-73633
Apache Struts: Unbounded read of a JSON request body
Same vendor: Apache Software Foundation
-
CVE-2026-75157
Apache Airflow: Asset queued-events DELETE endpoints gated o -
CVE-2026-92230
Apache Karaf: Improper release of ClassLoader references via -
CVE-2026-70469
Apache NiFi: Improper Handling of Case Sensitivity for Conte -
CVE-2026-81866
Apache NiFi: Missing Authorization for Assets and Secrets Re -
CVE-2026-82561
Apache NiFi: Missing Authorization for Components Referenced
V. Comments for CVE-2017-7672
No comments yet