CRITICAL🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇵🇱 Wersja polska

CVE-2020-17530

CVSS 9.8v3.1pub. 2020-12-11upd. 2025-10-27

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.

🇵🇱 Read Polish description →

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Struts
APP
Apache
2.0.0 – 2.5.30 (excl.)
Oracle Business Intelligence
APP
Oracle
12.2.1.3.012.2.1.4.0
Oracle Communications Diameter Intelligence Hub
APP
Oracle
8.0.08.1.08.2.08.2.3
Oracle Communications Policy Management
APP
Oracle
12.5.0
Oracle Communications Pricing Design Center
APP
Oracle
12.0.0.3.0
Oracle Financial Services Data Integration Hub
APP
Oracle
8.0.38.0.6
Oracle Hospitality Opera 5
APP
Oracle
5.6
Oracle MySQL Enterprise Monitor
APP
Oracle
8.0.23

CISA KEV — detailsi

Vendori: Apache ↗
Producti: Struts
Added to KEVi: November 3, 2021
Remediation deadline (US Federal)i: May 3, 2022(overdue)

🔧Advisory Apache↗🇺🇸CISA KEV (original)↗

Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution.

🔴