Lucene search
GoogleOSV:GHSA-V8J6-6C2R-R27CHistoryApr 13, 2022 - 12:00 a.m.
Expression Language Injection in Apache Struts
2022-04-1300:00:30
Google
osv.dev
62
0.973 High
EPSS
Percentile
99.9%
The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{…} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.
Related
cvelist
cvelist
CVE-2021-31805 Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.
2022-04-12 15:25:11
CVE-2020-17530
2020-12-11 01:11:04
prion
prion
Remote code execution
2022-04-12 16:15:00
Remote code execution
2020-12-11 02:15:00
openvas
openvas
Apache Struts Security Update (S2-062) - Active Check
2022-05-04 00:00:00
Apache Struts Security Update (S2-062) - Version Check
2022-04-13 00:00:00
Apache Struts Security Update (S2-061) - Version Check
2020-12-14 00:00:00
ubuntucve
ubuntucve
CVE-2021-31805
2022-04-12 00:00:00
CVE-2020-17530
2020-12-11 00:00:00
nuclei
nuclei
Apache Struts2 S2-062 - Remote Code Execution
2022-04-18 11:08:19
Apache Struts 2.0.0-2.5.25 - Remote Code Execution
2021-01-27 18:47:58
github
github
Expression Language Injection in Apache Struts
2022-04-13 00:00:30
Remote code execution in Apache Struts
2022-02-09 22:51:56
Bypassing OGNL sandboxes for fun and charities
2023-01-27 16:00:49
osv
osv
CVE-2021-31805
2022-04-12 16:15:08
CVE-2020-17530
2020-12-11 02:15:10
Remote code execution in Apache Struts
2022-02-09 22:51:56
nessus
nessus
Apache Struts 2.0.0 < 2.5.30 Possible Remote Code Execution vulnerability (S2-062)
2022-04-12 00:00:00
F5 Networks BIG-IP : Apache Struts vulnerabilities (K24608264)
2023-11-03 00:00:00
Apache Struts 2.x < 2.5.29 Remote Code Execution (S2-062)
2022-05-18 00:00:00
redhatcve
redhatcve
CVE-2021-31805
2022-04-13 06:28:32
CVE-2020-17530
2020-12-08 19:34:44
veracode
veracode
Remote Code Execution (RCE)
2022-04-13 04:46:59
Remote Code Execution
2020-12-09 05:42:42
cve
cve
CVE-2021-31805
2022-04-12 16:15:08
CVE-2020-17530
2020-12-11 02:15:10
nvd
nvd
CVE-2021-31805
2022-04-12 16:15:08
CVE-2020-17530
2020-12-11 02:15:10
attackerkb
attackerkb
CVE-2021-31805
2022-04-12 00:00:00
CVE-2020-17530
2020-12-11 00:00:00
ibm
ibm
f5
f5
Apache Struts vulnerabilities CVE-2020-17530 and CVE-2021-31805
2020-12-22 01:45:00
checkpoint_advisories
checkpoint_advisories
Apache Struts Remote Code Execution (CVE-2021-31805)
2022-05-02 00:00:00
Apache Struts Remote Code Execution (CVE-2020-17530)
2020-12-21 00:00:00
githubexploit
githubexploit
Exploit for Expression Language Injection in Apache Struts
2022-04-15 04:23:44
Exploit for Expression Language Injection in Apache Struts
2022-04-15 10:28:29
Exploit for Expression Language Injection in Apache Struts
2022-04-15 16:09:52
cnvd
cnvd
Apache Struts Remote Code Execution Vulnerability (CNVD-2023-02478)
2022-04-15 00:00:00
atlassian
atlassian
Update Apache Struts 2 to avoid CVE-2020-17530
2021-02-22 11:35:48
Update Apache Struts 2 to avoid CVE-2020-17530
2021-02-22 11:35:48
qualysblog
qualysblog
Apache Struts 2 Double OGNL Evaluation Vulnerability (CVE-2020-17530)
2021-09-21 14:40:00
Identify Server-Side Attacks Using Qualys Periscope
2022-12-01 23:11:35
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR
2022-02-23 05:39:00
cisa_kev
cisa_kev
Apache Struts Remote Code Execution Vulnerability
2021-11-03 00:00:00
cisa
cisa
Apache Releases Security Update for Apache Struts 2
2020-12-08 00:00:00
saint
saint
Apache Struts forced OGNL evaluation incomplete fix
2022-04-26 00:00:00
Apache Struts forced OGNL evaluation incomplete fix
2022-04-26 00:00:00
jvn
jvn
JVN#43969166: Apache Struts 2 vulnerable to remote code execution (S2-061)
2020-12-11 00:00:00
thn
thn
zdt
zdt
Apache Struts 2 Forced Multi OGNL Evaluation Exploit
2020-12-24 00:00:00
metasploit
metasploit
Apache Struts 2 Forced Multi OGNL Evaluation
2020-12-16 00:17:35
packetstorm
packetstorm
Apache Struts 2 Forced Multi OGNL Evaluation
2020-12-24 00:00:00
rapid7blog
rapid7blog
Metasploit Wrap-Up
2021-01-08 19:54:36
oracle
oracle
Oracle Critical Patch Update Advisory - January 2023
2023-01-17 00:00:00
Oracle Critical Patch Update Advisory - January 2021
2021-01-19 00:00:00
Oracle Critical Patch Update Advisory - October 2022
2022-10-18 00:00:00