CVE-2020-17530: Apache Struts Remote Code Execution Vulnerability
First published: Fri Dec 11 2020(Updated: )
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Struts 2 | ||
| Apache Struts 2 | >=2.0.0<2.5.30 | |
| Oracle Business Intelligence Enterprise Edition | =12.2.1.3.0 | |
| Oracle Business Intelligence Enterprise Edition | =12.2.1.4.0 | |
| Oracle Communications Diameter Intelligence Hub | =8.0.0 | |
| Oracle Communications Diameter Intelligence Hub | =8.1.0 | |
| Oracle Communications Diameter Intelligence Hub | =8.2.0 | |
| Oracle Communications Diameter Intelligence Hub | =8.2.3 | |
| Oracle Communications Policy Management | =12.5.0 | |
| Oracle Communications Pricing Design Center | =12.0.0.3.0 | |
| oracle financial services data integration hub | =8.0.3 | |
| oracle financial services data integration hub | =8.0.6 | |
| Oracle Hospitality OPERA | =5.6 | |
| MySQL Enterprise Monitor | =8.0.23 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://jvn.jp/en/jp/JVN43969166/index.html
- http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html
- http://www.openwall.com/lists/oss-security/2022/04/12/6
- https://cwiki.apache.org/confluence/display/WW/S2-061
- https://security.netapp.com/advisory/ntap-20210115-0005/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-17530
Frequently Asked Questions
What is the vulnerability ID of this Apache Struts vulnerability?
The vulnerability ID of this Apache Struts vulnerability is CVE-2020-17530.
What is the severity of CVE-2020-17530?
The severity of CVE-2020-17530 is critical with a score of 9.8.
What software is affected by CVE-2020-17530?
The affected software includes Apache Struts 2.0.0 - Struts 2.5.30, Oracle Business Intelligence 12.2.1.3.0 and 12.2.1.4.0, Oracle Communications Diameter Intelligence Hub 8.0.0, 8.1.0, 8.2.0, and 8.2.3, Oracle Communications Policy Management 12.5.0, Oracle Communications Pricing Design Center 12.0.0.3.0, Oracle Financial Services Data Integration Hub 8.0.3 and 8.0.6, Oracle Hospitality Opera 5.6, and Oracle MySQL Enterprise Monitor 8.0.23.
What is the vulnerability description of CVE-2020-17530?
CVE-2020-17530 is a vulnerability in Apache Struts that allows for remote code execution through forced OGNL evaluation.
How can CVE-2020-17530 be fixed?
To fix CVE-2020-17530, it is recommended to update to a patched version of Apache Struts or apply necessary security patches provided by the affected software vendors.
- agent/type
- agent/remedy
- agent/description
- agent/title
- agent/severity
- agent/weakness
- agent/first-publish-date
- agent/references
- agent/author
- agent/source
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/softwarecombine
- agent/event
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- collector/nvd-cve
- collector/nvd-index
- vendor/apache
- canonical/apache struts 2
- version/apache struts 2/2.0.0
- vendor/oracle
- canonical/oracle business intelligence enterprise edition
- version/oracle business intelligence enterprise edition/12.2.1.3.0
- version/oracle business intelligence enterprise edition/12.2.1.4.0
- canonical/oracle communications diameter intelligence hub
- version/oracle communications diameter intelligence hub/8.0.0
- version/oracle communications diameter intelligence hub/8.1.0
- version/oracle communications diameter intelligence hub/8.2.0
- version/oracle communications diameter intelligence hub/8.2.3
- canonical/oracle communications policy management
- version/oracle communications policy management/12.5.0
- canonical/oracle communications pricing design center
- version/oracle communications pricing design center/12.0.0.3.0
- canonical/oracle financial services data integration hub
- version/oracle financial services data integration hub/8.0.3
- version/oracle financial services data integration hub/8.0.6
- canonical/oracle hospitality opera
- version/oracle hospitality opera/5.6
- canonical/mysql enterprise monitor
- version/mysql enterprise monitor/8.0.23