Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
Published 2020-12-11 02:15:11
Updated 2022-06-03 16:38:02
View at NVD,   CVE.org
Vulnerability category: Execute code

CVE-2020-17530 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:
Apache Struts Remote Code Execution Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution.
Added on 2021-11-03 Action due date 2022-05-03

Exploit prediction scoring system (EPSS) score for CVE-2020-17530

97.26%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2020-17530

  • Apache Struts 2 Forced Multi OGNL Evaluation
    Disclosure Date: 2020-09-14
    First seen: 2020-12-23
    exploit/multi/http/struts2_multi_eval_ognl
    The Apache Struts framework, when forced, performs double evaluation of attributes' values assigned to certain tags attributes such as id. It is therefore possible to pass in a value to Struts that will be evaluated again when a tag's attributes are rendered. With a ca

CVSS scores for CVE-2020-17530

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
7.5
HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
6.4
NIST
9.8
CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.9
5.9
NIST

CWE ids for CVE-2020-17530

References for CVE-2020-17530

Products affected by CVE-2020-17530

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!