logo

Database

Remote command execution In org.apache.struts:struts2-core

Description

Remote code execution in Apache Struts Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2020-175302. NVD-2020-175303. OSV-2020-175304. GCVE-2020-17530

References

1. https://cwiki.apache.org/confluence/display/WW/S2-0612. https://security.netapp.com/advisory/ntap-20210115-00053. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-175304. https://www.oracle.com//security-alerts/cpujul2021.html5. https://www.oracle.com/security-alerts/cpuApr2021.html6. https://www.oracle.com/security-alerts/cpuapr2022.html7. https://www.oracle.com/security-alerts/cpujan2021.html8. https://www.oracle.com/security-alerts/cpujan2022.html9. https://www.oracle.com/security-alerts/cpuoct2021.html10. http://jvn.jp/en/jp/JVN43969166/index.html11. http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html12. http://www.openwall.com/lists/oss-security/2022/04/12/613. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17530.yaml14. https://github.com/secpool2000/CVE-2020-1753015. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts2_multi_eval_ognl.rb

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.