CyberSec.Space Logo
Back to CVE Browser

CVE-2020-17530

🔥 Known Exploited (CISA KEV)CRITICAL
9.8
CVSS Severity Score
EPSS Score83.0710%
EPSS Percentile85.96th
Published2020-12-11
Last Modified2025-10-27
Data SourcesNVDCISA KEVFIRST.org EPSS

Vulnerability Description

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.

Affected Platforms (CPE)

📦
Apache

Struts

>= 2.0.0 and < 2.5.30
📦
Oracle

Business Intelligence

= 12.2.1.3.0= 12.2.1.4.0
📦
Oracle

Communications Diameter Intelligence Hub

= 8.0.0= 8.1.0= 8.2.0= 8.2.3
📦
Oracle

Communications Policy Management

= 12.5.0

References & Advisories

🔗 http://jvn.jp/en/jp/JVN43969166/index.html
🔗 http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html
🔗 http://www.openwall.com/lists/oss-security/2022/04/12/6
🔗 https://cwiki.apache.org/confluence/display/WW/S2-061
🔗 https://security.netapp.com/advisory/ntap-20210115-0005/
🔗 https://www.oracle.com//security-alerts/cpujul2021.html
🔗 https://www.oracle.com/security-alerts/cpuApr2021.html
🔗 https://www.oracle.com/security-alerts/cpuapr2022.html

Related Vulnerabilities

CVE-2025-684938.1

Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; ...

CVE-2025-666758.2

Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue af...

CVE-2025-647757.5

Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue af...

CVE-2025-465819.8

ZTE's ZXCDN product is affected by a Struts remote code execution (RCE) vulnerability. An unauthenticated attacker can remotely e...