CVE-2020-17530: critical vulnerability in Apache Struts
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
Apache Struts 2 allows attackers to execute arbitrary code on the server by injecting malicious expressions into tag attributes. This happens because user input is evaluated as code without proper validation, giving attackers complete control over the affected system.
A forced Object-Graph Navigation Language (OGNL) evaluation vulnerability exists in Apache Struts 2.0.0 through 2.5.25 where raw user input in tag attributes is processed as executable expressions. An unauthenticated attacker can inject malicious OGNL payloads through web request parameters to achieve remote code execution with server privileges; no authentication or special preconditions are required.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.