9.8
Critique
Exploitée
CVE-2020-17530 Apache Struts Remote Code Execution Vulnerability
Exploitation active constatée
· catalogue CISA KEV
Action attendue
Apply updates per vendor instructions.
Campagnes de rançongiciel
Non constatée à ce jour
Faiblesse
CWE-917
Description
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Struts | Versions non publiées |
Références
- cwiki.apache.org cwiki.apache.org
- JVN#43969166 jvn.jp
- www.oracle.com www.oracle.com
- packetstormsecurity.com packetstormsecurity.com
- security.netapp.com security.netapp.com
- www.oracle.com www.oracle.com
- www.oracle.com www.oracle.com
- www.oracle.com www.oracle.com
- www.oracle.com www.oracle.com
- [oss-security] 20220412 CVE-2021-31805: Apache Struts: Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE. www.openwall.com
- www.oracle.com www.oracle.com
Chronologie
- Publiée
- Ajoutée au catalogue KEV
- Dernière modification
Autres CVE de Apache Struts
Les 33 CVE de Apache Struts →
CVE-2026-104714
Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache…
Non notée
CVE-2026-104713
Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin
Non notée
CVE-2026-104712
Asymmetric resource consumption (amplification) vulnerability in Apache Struts
Non notée
CVE-2026-104711
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection')…
Non notée