Read the docs
TI-2020-13278 Aliases CVE-2020-17530GHSA-jc35-q369-45pv

Expression language injection in Apache Struts

Priority CRITICAL 100Exploited in the wildCWE-917Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-917.

Summary

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.

Why it matters now

Exploitation Active In CISA KEV since 2021-11-03CISA due date 2022-05-03
EPSS 0.96251 99th percentileScored 2026-11-07
Fix Fixed org.apache.struts:struts2-core (Maven): 2.5.26

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache StrutsStruts 2.0.0 - Struts 2.5.25—No fix listedCNA
—org.apache.struts:struts2-core (Maven)2.0.0 to before 2.5.262.5.26Patch availableGHSA-jc35-q369-45pv
  • Apache Struts VendorApache Affected Struts 2.0.0 - Struts 2.5.25 Fixed in — No fix listed CNA
  • org.apache.struts:struts2-core (Maven) Vendor— Affected 2.0.0 to before 2.5.26 Fixed in 2.5.26 Patch available GHSA-jc35-q369-45pv

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*2.0.0 to before 2.5.30VulnerableApache
cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.0.0:*:*:*:*:*:*:*8.0.0VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.1.0:*:*:*:*:*:*:*8.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.2.0:*:*:*:*:*:*:*8.2.0VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.2.3:*:*:*:*:*:*:*8.2.3VulnerableOracle
cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*12.5.0VulnerableOracle
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*12.0.0.3.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.3:*:*:*:*:*:*:*8.0.3VulnerableOracle
  • cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.5.30 Vulnerable ·Apache
  • cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.2.0:*:*:*:*:*:*:* Versions 8.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.2.3:*:*:*:*:*:*:* Versions 8.2.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:* Versions 12.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.3:*:*:*:*:*:*:* Versions 8.0.3 Vulnerable ·Oracle
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.6:*:*:*:*:*:*:*8.0.6VulnerableOracle
cpe:2.3:a:oracle:hospitality_opera_5:5.6:*:*:*:*:*:*:*5.6VulnerableOracle
cpe:2.3:a:oracle:mysql_enterprise_monitor:8.0.23:*:*:*:*:*:*:*8.0.23VulnerableOracle
  • cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.6:*:*:*:*:*:*:* Versions 8.0.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_opera_5:5.6:*:*:*:*:*:*:* Versions 5.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql_enterprise_monitor:8.0.23:*:*:*:*:*:*:* Versions 8.0.23 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-jc35-q369-45pv org.apache.struts:struts2-core (Maven) Fixed in 2.5.26 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 4 products
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Fuse 6
  • Red Hat JBoss Fuse Service Works 6
  • Red Hat JBoss Operations Network 3

Timeline

  1. 2021-11-03 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2020-17530
  3. 2026-10-03 Alias added: GHSA-jc35-q369-45pv

References

Patch 6

Advisory 6

Other 3

  • TI-2017-07171 Improper input validation in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2013-02013 Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL… KEVCVSS 3.1CRITICAL 9.8
  • TI-2012-00357 The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-08433 Improper input validation in Apache Struts KEVCVSS 3.1HIGH 8.1
  • TI-2017-07185 Deserialization of untrusted data in Apache Struts KEVCVSS 3.1HIGH 8.1
See all 98 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences