// For flags

CVE-2019-0230

Apache Struts 2 Forced Multi OGNL Evaluation

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

10
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

Apache Struts versiones 2.0.0 hasta 2.5.20, forzó una evaluación OGNL doble, cuando se evaluaba en la entrada del usuario sin procesar en los atributos de la etiqueta, puede conllevar a una ejecución de código remota

The Apache Struts framework, when forced, performs double evaluation of attribute values assigned to certain tags attributes such as id. It is therefore possible to pass in a value to Struts that will be evaluated again when a tag's attributes are rendered. With a carefully crafted request, this can lead to remote code execution. This vulnerability is application dependant. A server side template must make an affected use of request data to render an HTML tag attribute.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-11-14 CVE Reserved
  • 2020-08-13 First Exploit
  • 2020-09-14 CVE Published
  • 2024-08-04 CVE Updated
  • 2024-08-21 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CAPEC
References (22)
URL Tag Source
https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E Mailing List
https://cwiki.apache.org/confluence/display/WW/S2-059
https://cwiki.apache.org/confluence/display/WW/S2-061
https://github.com/vulhub/vulhub/tree/master/struts2/s2-059
https://github.com/vulhub/vulhub/tree/master/struts2/s2-061
https://securitylab.github.com/advisories/GHSL-2020-205-double-eval-dynattrs-struts2
https://github.com/ka1n4t/CVE-2020-17530
URL Date SRC
https://www.exploit-db.com/exploits/49068 2020-11-17
https://github.com/PrinceFPF/CVE-2019-0230 2020-08-13
https://github.com/BH2UOL/CVE-2019-0230 2020-08-13
https://github.com/ramoncjs3/CVE-2019-0230 2020-08-21
https://github.com/Al1ex/CVE-2019-0230 2020-12-11
https://github.com/fengziHK/CVE-2019-0230 2020-12-08
https://github.com/f8al/CVE-2019-0230-PoC 2020-10-22
http://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.html 2024-08-04
http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html 2024-08-04
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/struts2_multi_eval_ognl.rb 2020-09-14
URL Date SRC
https://www.oracle.com/security-alerts/cpuApr2021.html 2023-11-07
https://www.oracle.com/security-alerts/cpujan2021.html 2023-11-07
https://www.oracle.com/security-alerts/cpuoct2021.html 2023-11-07
URL Date SRC
https://cwiki.apache.org/confluence/display/ww/s2-059 2023-11-07
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
 Struts
Search vendor "Apache" for product "Struts"
 >= 2.0.0 <= 2.5.20
Search vendor "Apache" for product "Struts" and version " >= 2.0.0 <= 2.5.20"
-
Affected
Oracle
Search vendor "Oracle"
 Communications Policy Management
Search vendor "Oracle" for product "Communications Policy Management"
 12.5.0
Search vendor "Oracle" for product "Communications Policy Management" and version "12.5.0"
-
Affected
Oracle
Search vendor "Oracle"
 Financial Services Data Integration Hub
Search vendor "Oracle" for product "Financial Services Data Integration Hub"
 8.0.3
Search vendor "Oracle" for product "Financial Services Data Integration Hub" and version "8.0.3"
-
Affected
Oracle
Search vendor "Oracle"
 Financial Services Data Integration Hub
Search vendor "Oracle" for product "Financial Services Data Integration Hub"
 8.0.6
Search vendor "Oracle" for product "Financial Services Data Integration Hub" and version "8.0.6"
-
Affected
Oracle
Search vendor "Oracle"
 Financial Services Market Risk Measurement And Management
Search vendor "Oracle" for product "Financial Services Market Risk Measurement And Management"
 8.0.6
Search vendor "Oracle" for product "Financial Services Market Risk Measurement And Management" and version "8.0.6"
-
Affected
Oracle
Search vendor "Oracle"
 Mysql Enterprise Monitor
Search vendor "Oracle" for product "Mysql Enterprise Monitor"
 <= 8.0.23
Search vendor "Oracle" for product "Mysql Enterprise Monitor" and version " <= 8.0.23"
-
Affected