CVE-2021-31805

Description

The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tags attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

93.956

Associated Vulnerability

Vulnerability	OS Platform
Apache Struts Vulnerability (CVE-2021-31805)	Windows
Vulnerabilities CVE-2021-31805 are fixed in Apache-struts2-core 2.5.30	Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 10.5	Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 10.6	Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 11.1	Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 11.2	Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 11.3	Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 11.4	Windows
Multiple Vulnerabilities are affected in IBM Tivoli Application Dependency Discovery Manager 7.3.0.9	Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 11.0	Windows
Vulnerabilities CVE-2021-31805 are fixed in Apache-structs2-core for Linux 2.5.30	Linux
Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection) Vulnerability (CVE-2021-31805)	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234