logo

Database

Prototype Pollution In org.apache.struts:struts2-core

Description

Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2019-02302. NVD-2019-02303. OSV-2019-02304. GCVE-2019-0230

References

1. https://cwiki.apache.org/confluence/display/ww/s2-0592. https://launchpad.support.sap.com/#/notes/29828403. https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7@%3Cannounce.apache.org%3E4. https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922@%3Cannounce.apache.org%3E5. https://www.oracle.com/security-alerts/cpuApr2021.html6. https://www.oracle.com/security-alerts/cpujan2021.html7. https://www.oracle.com/security-alerts/cpuoct2021.html8. http://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.html9. http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html10. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-0230.yaml11. https://github.com/PrinceFPF/CVE-2019-023012. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts2_multi_eval_ognl.rb

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.