CRITICALCVSS v3.1 9.8Actively exploited · CISA KEV since 2022-02-10Vulnerability

CVE-2017-9791

The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

Properties

Euvd product
Apache Struts
Vulnerability name
Apache Struts 1 Improper Input Validation Vulnerability
First seen
2025-10-21T23:55:38+00:00
Cvss score
9.8
Epss score
0.98908
Last seen
2026-10-19T12:00:27+00:00
Due date
2022-08-10
Euvd assigner
apache
Retrieved at
2026-10-21T01:24:47+00:00
Exploited euvd since
2022-02-10T00:00:00+00:00
Src batch id
epss_history-20261020T103617Z-728ddd
Source url
https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
Date added
2022-02-10
Score
9.8
Euvd base score version
3.1
Fetched at
2026-10-20T10:36:20+00:00
Euvd vendor
Apache Software Foundation
Cvss vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In Signal since
initial import (Sep 2026)
Euvd base score
9.8

Related Entities (36 · showing 23)

AFFECTS_PRODUCT (33 · showing 20)

→[Product]cpe:2.3:a:apache:struts:2.3.31:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:struts:2.3.32:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:*

DESCRIBES (1)

←[KEVEntry]Apache Struts 1 Improper Input Validation Vulnerability

HAS_WEAKNESS (1)

→[Weakness]Improper Input Validation

INVOLVES (1)

←[Signal]kev_added · 2022-02-10

Explore deeper with Ninja Signal's threat intelligence graph

Search in SpektrOpen Signal Desktop
CVE-2017-9791 (CVSS v3.1 9.8) — Ninja Signal Threat Intelligence | Ninja Signal