Remote Code Execution (RCE) Affecting org.apache.struts:struts2-core package, versions [2.0.0, 2.5.22)
Threat Intelligence
Exploit Maturity
Mature
EPSS
95.13% (100th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHESTRUTS-608097
- published 21 Aug 2020
- disclosed 11 Aug 2020
- credit Matthias Kaiser
Introduced: 11 Aug 2020
CVE-2019-0230 Open this link in a new tabHow to fix?
Upgrade org.apache.struts:struts2-core to version 2.5.22 or higher.
Overview
org.apache.struts:struts2-core is a popular open-source framework for developing web applications in the Java programming language.
Affected versions of this package are vulnerable to Remote Code Execution (RCE). Forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
References
CVSS Scores
version 3.1