CVE-2020-17530: Apache Struts Remote Code Execution Vulnerability
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
Other sources
Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution.
— CISA
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this Apache Struts vulnerability?
The vulnerability ID of this Apache Struts vulnerability is CVE-2020-17530.
What is the severity of CVE-2020-17530?
The severity of CVE-2020-17530 is critical with a score of 9.8.
What software is affected by CVE-2020-17530?
The affected software includes Apache Struts 2.0.0 - Struts 2.5.30, Oracle Business Intelligence 12.2.1.3.0 and 12.2.1.4.0, Oracle Communications Diameter Intelligence Hub 8.0.0, 8.1.0, 8.2.0, and 8.2.3, Oracle Communications Policy Management 12.5.0, Oracle Communications Pricing Design Center 12.0.0.3.0, Oracle Financial Services Data Integration Hub 8.0.3 and 8.0.6, Oracle Hospitality Opera 5.6, and Oracle MySQL Enterprise Monitor 8.0.23.
What is the vulnerability description of CVE-2020-17530?
CVE-2020-17530 is a vulnerability in Apache Struts that allows for remote code execution through forced OGNL evaluation.
How can CVE-2020-17530 be fixed?
To fix CVE-2020-17530, it is recommended to update to a patched version of Apache Struts or apply necessary security patches provided by the affected software vendors.