CVE-2020-17530

nvd nist nuclei

Published: Dec 11, 2020Modified: Oct 27, 2025CISA KEV

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.

Affected (13)

Products: Apache: Struts · Oracle: Business Intelligence, Communications Diameter Intelligence Hub, Communications Policy Management, Communications Pricing Design Center, Financial Services Data Integration Hub, Hospitality Opera 5, Mysql Enterprise Monitor

1 product

7 products

Business Intelligence

Communications Diameter Intelligence Hub

Communications Policy Management

Communications Pricing Design Center

Financial Services Data Integration Hub

Hospitality Opera 5

Mysql Enterprise Monitor

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Struts	From 2.0.0 to 2.5.30

Configuration B

12 vulnerable

Vulnerable Software	Affected Versions
Oracle Business Intelligence	Version 12.2.1.3.0
Oracle Business Intelligence	Version 12.2.1.4.0
Oracle Communications Diameter Intelligence Hub	Version 8.0.0
Oracle Communications Diameter Intelligence Hub	Version 8.1.0
Oracle Communications Diameter Intelligence Hub	Version 8.2.0
Oracle Communications Diameter Intelligence Hub	Version 8.2.3
Oracle Communications Policy Management	Version 12.5.0
Oracle Communications Pricing Design Center	Version 12.0.0.3.0
Oracle Financial Services Data Integration Hub	Version 8.0.3
Oracle Financial Services Data Integration Hub	Version 8.0.6
Oracle Hospitality Opera 5	Version 5.6
Oracle Mysql Enterprise Monitor	Version 8.0.23

Related CWEs

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

References (23)

http://jvn.jp/en/jp/JVN43969166/index.html

Source: security@apache.org

Third Party Advisory

http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html

Source: security@apache.org

Third Party AdvisoryVDB Entry

http://www.openwall.com/lists/oss-security/2022/04/12/6

Source: security@apache.org

Mailing ListThird Party Advisory

https://cwiki.apache.org/confluence/display/WW/S2-061

Source: security@apache.org

Vendor Advisory

https://security.netapp.com/advisory/ntap-20210115-0005/

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: security@apache.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: security@apache.org

PatchThird Party Advisory

http://jvn.jp/en/jp/JVN43969166/index.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.openwall.com/lists/oss-security/2022/04/12/6

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://cwiki.apache.org/confluence/display/WW/S2-061

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://security.netapp.com/advisory/ntap-20210115-0005/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-17530

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.