Critical severity · published Sep 14, 2020
CVE-2019-0230
Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution
9.8
CVSS
96.9%
EPSS
No
On KEV
Description
Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)96.9% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
Struts · Apache
2.0.0 through 2.5.20 · source: NVD
CP
Communications Policy Management · Oracle
12.5.0 · source: NVD
FS
Financial Services Data Integration Hub · Oracle
8.0.3; 8.0.6 · source: NVD
FS
Financial Services Market Risk Measurement And Management · Oracle
8.0.6 · source: NVD
ME
Mysql Enterprise Monitor · Oracle
through 8.0.23 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0230
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0230
Exploit
http://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.html
Exploit
http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html
Vendor Advisory
https://cwiki.apache.org/confluence/display/ww/s2-059
Permissions Required
https://launchpad.support.sap.com/#/notes/2982840
lists.apache.org
https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E
More from Struts
9.8
CVE-2020-17530
Apache Struts Remote Code Execution Vulnerability
9.8
CVE-2017-9791
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage
9.8
CVE-2017-5638
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload…
9.8
CVE-2013-2251
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction:…
9.8
CVE-2012-0391
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of…