CVE-2020-17530 | SynScan

Vulnerability Database

289,697

Total vulnerabilities in the database

CVE-2020-17530

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.

Published: Dec 11, 2020
Updated: May 9, 2024
CVE: CVE-2020-17530
GHSA: GHSA-jc35-q369-45pv
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

OWASP TOP 10:

A1 - Injection

Affected Software
References

Software	From	Fixed in
apache / struts	2.0.0	2.5.30
oracle / business_intelligence	12.2.1.3.0	12.2.1.3.0.x
oracle / business_intelligence	12.2.1.4.0	12.2.1.4.0.x
oracle / communications_policy_management	12.5.0	12.5.0.x
oracle / financial_services_data_integration_hub	8.0.6	8.0.6.x
oracle / financial_services_data_integration_hub	8.0.3	8.0.3.x
oracle / hospitality_opera_5	5.6	5.6.x
oracle / communications_pricing_design_center	12.0.0.3.0	12.0.0.3.0.x
oracle / mysql_enterprise_monitor	8.0.23	8.0.23.x
oracle / communications_diameter_intelligence_hub	8.2.3	8.2.3.x
oracle / communications_diameter_intelligence_hub	8.0.0	8.0.0.x
oracle / communications_diameter_intelligence_hub	8.2.0	8.2.0.x
oracle / communications_diameter_intelligence_hub	8.1.0	8.1.0.x
org.apache.struts / struts2-core	2.0.0	2.5.26