Not rated
CVE-2021-31805 The fix issued for CVE-2020-17530 was incomplete
Description
The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Struts | Versions not published |
References
- cwiki.apache.org cwiki.apache.org
- [oss-security] 20220412 CVE-2021-31805: Apache Struts: Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE. www.openwall.com
- www.oracle.com www.oracle.com
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified
Other CVEs of Apache Struts
The 33 CVEs of Apache Struts →
CVE-2026-104714
Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache…
Not rated
CVE-2026-104713
Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin
Not rated
CVE-2026-104712
Asymmetric resource consumption (amplification) vulnerability in Apache Struts
Not rated
CVE-2026-104711
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection')…
Not rated