CVE-2017-9787 High Severity Vulnerability detected by WhiteSource

[mend-bolt-for-github]

CVE-2017-9787 - High Severity Vulnerability

Vulnerable Libraries - xwork-core-2.3.31.jar, struts2-core-2.3.31.jar

xwork-core-2.3.31.jar

Apache Struts 2

path: /root/.m2/repository/org/apache/struts/xwork/xwork-core/2.3.31/xwork-core-2.3.31.jar

Library home page: http://struts.apache.org/xwork-core/

Dependency Hierarchy:

• struts2-core-2.3.31.jar (Root Library)
  • ❌ xwork-core-2.3.31.jar (Vulnerable Library)

struts2-core-2.3.31.jar

Apache Struts 2

path: 2/repository/org/apache/struts/struts2-core/2.3.31/struts2-core-2.3.31.jar

Library home page: http://struts.apache.org/struts2-core/

Dependency Hierarchy:

• ❌ struts2-core-2.3.31.jar (Vulnerable Library)

Found in HEAD commit: 23068bfa8fba8e934988efafc64fa2cf0fdb8462

Vulnerability Details

When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33.

Publish Date: 2017-07-13

URL: CVE-2017-9787

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://struts.apache.org/docs/s2-049.html

Fix Resolution: Upgrade to Struts 2.5.12 or Struts 2.3.33

---

Step up your Open Source Security Game with WhiteSource here