CVE-2019-0230 : Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lea

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

Published 2020-09-14 17:15:10

Updated 2022-12-02 19:47:57

Source Apache Software Foundation

View at NVD, CVE.org

Vulnerability category: Execute code

Exploit prediction scoring system (EPSS) score for CVE-2019-0230

EPSS FAQ

95.38%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2019-0230

Apache Struts 2 Forced Multi OGNL Evaluation

Disclosure Date: 2020-09-14

First seen: 2020-12-23

exploit/multi/http/struts2_multi_eval_ognl

The Apache Struts framework, when forced, performs double evaluation of attributes' values assigned to certain tags attributes such as id. It is therefore possible to pass in a value to Struts that will be evaluated again when a tag's attributes are rendered. With a ca

More information

CVSS scores for CVE-2019-0230

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-0230

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-0230

http://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.html

Apache Struts 2.5.20 Double OGNL Evaluation ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html

Apache Struts 2 Forced Multi OGNL Evaluation ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry

CVEs referencing this url
https://launchpad.support.sap.com/#/notes/2982840

SAP ONE Support Launchpad: Log On
Permissions Required

CVEs referencing this url
https://www.oracle.com/security-alerts/cpujan2021.html

Oracle Critical Patch Update Advisory - January 2021
Patch;Third Party Advisory

CVEs referencing this url
https://www.oracle.com/security-alerts/cpuApr2021.html

Oracle Critical Patch Update Advisory - April 2021
Patch;Third Party Advisory

CVEs referencing this url
https://cwiki.apache.org/confluence/display/ww/s2-059

S2-059 - Apache Struts 2 Wiki - Apache Software Foundation
Vendor Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html

Oracle Critical Patch Update Advisory - October 2021
Patch;Third Party Advisory

CVEs referencing this url
https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7@%3Cannounce.apache.org%3E

Re: Apache Software Foundation Security Report: 2020 - Pony Mail
Mailing List;Vendor Advisory

CVEs referencing this url
https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922@%3Cannounce.apache.org%3E

Apache Software Foundation Security Report: 2020 - Pony Mail
Mailing List;Vendor Advisory

CVEs referencing this url

Products affected by CVE-2019-0230

Apache » Struts
Versions from including (>=) 2.0.0 and up to, including, (<=) 2.5.20
cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql Enterprise Monitor
Versions up to, including, (<=) 8.0.23
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*
Matching versions
Oracle » Communications Policy Management » Version: 12.5.0
cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*
Matching versions
Oracle » Financial Services Market Risk Measurement And Management » Version: 8.0.6
cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:*
Matching versions
Oracle » Financial Services Data Integration Hub » Version: 8.0.3
cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.3:*:*:*:*:*:*:*
Matching versions
Oracle » Financial Services Data Integration Hub » Version: 8.0.6
cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.6:*:*:*:*:*:*:*
Matching versions