What’s Vulnerable › Vulnerabilities

CVE-2020-17530: Apache Struts Remote Code Execution Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2021-11-03
• EPSS: 96.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-12-11 · updated 2026-06-17
• Weakness: CWE-917

Description

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.

Affected products

• Apache Struts: from 2.0.0 before 2.5.30 — fixed in 2.5.30
• Oracle Corporation Oracle Business Intelligence Enterprise Edition: 12.2.1.3.0, 12.2.1.4.0
• Oracle Communications Diameter Intelligence Hub: 8.0.0, 8.1.0, 8.2.0, 8.2.3
• Oracle Corporation Communications Policy Management: 12.5.0
• Oracle Corporation Communications Pricing Design Center: 12.0.0.3.0
• Oracle Financial Services Data Integration Hub: 8.0.3, 8.0.6
• Oracle Corporation Oracle Hospitality OPERA 5: 5.6
• Oracle Corporation MySQL Enterprise Monitor: 8.0.23

How to fix

Upgrade to a fixed version: Apache Struts 2.5.30. Check the vendor advisory for mitigations.

References

• http://jvn.jp/en/jp/JVN43969166/index.html
• http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html
• http://www.openwall.com/lists/oss-security/2022/04/12/6
• https://cwiki.apache.org/confluence/display/WW/S2-061
• https://security.netapp.com/advisory/ntap-20210115-0005/
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2021.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpuoct2021.html
• http://jvn.jp/en/jp/JVN43969166/index.html

Get alerted when CVE-2020-17530 or the next vulnerability affects your stack