$ cve CVE-2020-17530 JSON

CVE-2020-17530 KEV

9.8

CRITICAL · CVSS 3.1 · EPSS 95.9% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-05-03.

Description

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	95.93% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-917
On CISA KEV	yes — remediate by 2022-05-03
Public exploit	none known
Published	2020-12-11
Last modified	2026-06-17

CISA KEV

Name	Apache Struts Remote Code Execution Vulnerability
Added	2021-11-03
Due	2022-05-03
Vendor / product	Apache / Struts
Ransomware use	none reported

Affected (8)

Vendor	Product
apache	struts
oracle	business intelligence
oracle	communications diameter intelligence hub
oracle	communications policy management
oracle	communications pricing design center
oracle	financial services data integration hub
oracle	hospitality opera 5
oracle	mysql enterprise monitor

References

→ the Explorer · watch your stack · NVD