CVE-2020-17530

Description

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

94.376

Associated Vulnerability

Vulnerability	OS Platform
Apache Struts Vulnerability (CVE-2020-17530)	Windows
Vulnerabilities CVE-2020-17530 are fixed in Apache-struts2-core 2.5.26	Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 10.5	Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 10.6	Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 11.1	Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 11.2	Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 11.3	Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 11.0	Windows
Multiple Vulnerabilities are affected in IBM Tivoli Application Dependency Discovery Manager 7.3.0.8	Windows
Vulnerabilities CVE-2020-17530 are fixed in Apache-structs2-core for Linux 2.5.26	Linux
Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection) Vulnerability (CVE-2020-17530)	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234