CVE-2019-0230

nvd nist nuclei

Published: Sep 14, 2020Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

Affected (6)

Products: Apache: Struts · Oracle: Communications Policy Management, Financial Services Data Integration Hub, Financial Services Market Risk Measurement And Management, Mysql Enterprise Monitor

1 product

4 products

Communications Policy Management

Financial Services Data Integration Hub

Financial Services Market Risk Measurement And Management

Mysql Enterprise Monitor

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Struts	From 2.0.0 to 2.5.20

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Policy Management	Version 12.5.0
Oracle Financial Services Data Integration Hub	Version 8.0.3
Oracle Financial Services Data Integration Hub	Version 8.0.6
Oracle Financial Services Market Risk Measurement And Management	Version 8.0.6
Oracle Mysql Enterprise Monitor	Up to 8.0.23

Related CWEs

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

References (18)

http://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.html

Source: security@apache.org

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html

Source: security@apache.org

ExploitThird Party AdvisoryVDB Entry

https://cwiki.apache.org/confluence/display/ww/s2-059

Source: security@apache.org

Vendor Advisory

https://launchpad.support.sap.com/#/notes/2982840

Source: security@apache.org

Permissions Required

https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E

Source: security@apache.org

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: security@apache.org

PatchThird Party Advisory

http://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

https://cwiki.apache.org/confluence/display/ww/s2-059

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://launchpad.support.sap.com/#/notes/2982840

Source: af854a3a-2127-422b-91ae-364da2661108

Permissions Required

https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.