# MA-680.092017: MyCERT Advisory - Multiple Cisco Products Affected By Multiple Apache Struts Vulnerabilities

**Date:** 14 Sep 2017  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-680.092017  
**Advisory ID:** MA-680.092017

---

**1.0 Introduction**
On September 5, 2017, the Apache Software Foundation released security bulletins that disclosed three vulnerabilities in the Apache Struts 2 package. Of these vulnerabilities, the Apache Software Foundation classifies one as Critical Severity, one as Medium Severity, and one as Low Severity.
Multiple Cisco products incorporate a version of the Apache Struts 2 package those are affected by these vulnerabilities. List of vulnerabilities are as below:
• Apache Struts REST Plug-In XML Processing Arbitrary Code Execution Vulnerability (CVE-2017-9805)
• Apache Struts REST Plug-n Denial of Service Vulnerability (CVE-2017-9793)
• Apache Struts URL Validator Resource Exhaustion Denial of Service Vulnerability (CVE-2017-9804)
**2.0 Impact**
A successful exploit could allow the attacker to execute arbitrary code and/or to cause a Denial of Service (DoS) condition on a targeted product or system.
**3.0 Affected Products**
Users and administrators are recommended to review the below URL for the list of affected products:
• <https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor, apply necessary updates and follow best practice security policies.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#1f7c667d7a6d2626265f7c667d7a6d6c7a7c6a6d766b66317266) or [[email protected]](/cdn-cgi/l/email-protection#7815011b1d0a0c3815011b1d0a0c56170a1f561501)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**4.0 References**
• <https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2>
• <https://www.bleepingcomputer.com/news/security/apache-struts-vulnerabilities-may-affect-many-of-ciscos-products/>
• [h](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170909-struts2-rce)[ttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170909-struts2-rce](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170909-struts2-rce)