{"result":"OK","data":{"documents":{"CVE-2019-0230":{"id":"CVE-2019-0230","vendorId":null,"type":"cve","bulletinFamily":"cve","title":"CVE-2019-0230","description":"Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.","attachments":[],"timestamps":{"created":"2020-09-14T14:15:09Z","updated":"2026-09-03T01:21:10.487000Z","enriched":"2026-09-03T01:21:10.487000Z","reviewed":"2026-08-24T14:28:35.374000Z","webApplicabilityUpdated":"2026-08-25T14:26:50.373000Z","metricsUpdated":"2026-07-23T00:14:49.396000Z","contentUpdated":"2026-08-24T05:15:24.919000Z"},"published":"2020-09-14T16:41:27","modified":"2026-06-17T02:08:02","epss":[{"cve":"CVE-2019-0230","epss":0.97112,"percentile":0.99888,"date":"2026-09-03"}],"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"nvd"},"metrics":{"nvd":{"cvss2":{"source":"nvd","version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false,"temporalScore":7.5},"cvss31":{"source":"nvd","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}}},"cvss2":{"cvssV2":{"source":"nvd","version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false,"temporalScore":7.5}},"cvss3":{"cvssV31":{"source":"nvd","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"cvss4":{},"href":"https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-0230","sourceAvailable":true,"reporter":"apache","references":["https://cwiki.apache.org/confluence/display/ww/s2-059","https://www.oracle.com/security-alerts/cpuApr2021.html","https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E","http://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.html","https://www.oracle.com/security-alerts/cpujan2021.html","http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html","https://launchpad.support.sap.com/#/notes/2982840"],"cvelist":["CVE-2019-0230"],"immutableFields":[],"lastseen":"2026-08-24T05:15:24","viewCount":508,"enchantments":{"dependencies":{"references":[{"type":"atlassian","idList":["ATLASSIAN:CONFSERVER-60189","ATLASSIAN:CONFSERVER-60264","CONFSERVER-60264"]},{"type":"attackerkb","idList":["AKB:289DC3CE-ED8A-4366-89F0-46E148584C36","AKB:CF76EF1F-CB59-4A29-ADB1-DA37C695142B"]},{"type":"bdu_fstec","idList":["BDU:2021-01011"]},{"type":"circl","idList":["CIRCL:CVE-2019-0230"]},{"type":"cisa","idList":["CISA:3D9E69A26C68866B64ED6E4B31E270E6"]},{"type":"cnvd","idList":["CNVD-2020-46202"]},{"type":"cvelist","idList":["CVELIST:CVE-2019-0230"]},{"type":"exploitdb","idList":["EDB-ID:49068"]},{"type":"f5","idList":["F5:K35226442"]},{"type":"github","idList":["GHSA-WP4H-PVGW-5727"]},{"type":"githubexploit","idList":["453574C2-C801-529D-A0A6-5C5E1471F1AC","4E339DB6-4704-5991-B690-DF8D7307532E","5E7409E5-7716-5F40-999C-E6622B806F5E","B1E738E0-BF1B-50E1-88E2-1D265CF9AEB8","BD05B538-25EA-5C42-AE8D-229D78B57CB1"]},{"type":"huawei","idList":["HUAWEI-SA-20200902-01-STRUTS2"]},{"type":"ibm","idList":["07F7EC96AB11A92B354685B1D588EB2F07369BF8E6583AE640FC000B1D7E956B","20DAAA2A40C4A633F7230B8255F0CADBA6E88A77DD305EC21132BECBFF011089","3477DD0939B4B8CC59240F8DCC09305A2F7C13CA45285602F1755CDF6F593B52","35DB525D4E07A09A6F2976ED4B93F380507E2F51F096B5749BE6E096C57DD8BD","43ABDDEF8A51FB28FC8C4825BAD26A0A25F5F21805BFC87561A0AEABFD065F37","461BBFF276D2BD07EE935B18691B56E01933360B1B42DAE8AAFFC1167BCA5486","60BC7D4DCC3D358CA3A091D2D1C15EE5A67539C2664E72739BD35D6406A88E4A","80737D4B4CE626670083B16CA387FEFAC8045ECB16DACD55AD56FFAC544F21A4","9235ED396A90BB944C2B22072DE6B91B22155C3982DDD732067344CA700C0ADE","C22DE952FD6E1544B14AE2735F81ACAE3EF08509FC895F0AAF0AC7485A98F798","C6AE70E5471CDF678253E267AB7C45FA772A777F24502EE50E243BD88E300D13"]},{"type":"kitploit","idList":["KITPLOIT:TOOLS-GITHUB-AL1EX-CVE-2019-0230","KITPLOIT:TOOLS-GITHUB-F8AL-CVE-2019-0230-POC","KITPLOIT:TOOLS-GITHUB-PRINCEFPF-CVE-2019-0230","KITPLOIT:TOOLS-GITHUB-RAMONCJS3-CVE-2019-0230"]},{"type":"metasploit","idList":["MSF:EXPLOIT-MULTI-HTTP-STRUTS2_MULTI_EVAL_OGNL-"]},{"type":"ncsc","idList":["NCSC-2020-0653","NCSC-2020-0919","NCSC-2021-0071"]},{"type":"nessus","idList":["F5_BIGIP_SOL35226442.NASL","REDHAT_UNPATCHED-STRUTS2-RHEL5.NASL","STRUTS_2_5_22.NASL","WEB_APPLICATION_SCANNING_112766"]},{"type":"nuclei","idList":["NUCLEI:CVE-2019-0230"]},{"type":"nvd","idList":["NVD:CVE-2019-0230"]},{"type":"openvas","idList":["OPENVAS:1361412562310144399","OPENVAS:1361412562310144400"]},{"type":"oracle","idList":["ORACLE:CPUAPR2021","ORACLE:CPUJAN2021","ORACLE:CPUOCT2021"]},{"type":"osv","idList":["OSV:GHSA-WP4H-PVGW-5727"]},{"type":"packetstorm","idList":["PACKETSTORM:160108","PACKETSTORM:160721"]},{"type":"prion","idList":["PRION:CVE-2019-0230"]},{"type":"ptsecurity","idList":["PT-2020-5513"]},{"type":"rapid7blog","idList":["RAPID7BLOG:5482AC1594C82A230828023816657B57"]},{"type":"redhatcve","idList":["RH:CVE-2019-0230"]},{"type":"saint","idList":["SAINT:1126B0AA9A8BD987E404F1746F1D8BFA","SAINT:891A42933A0DE986694E3B7D51B3F2F1","SAINT:AE1DA80E6B0E4C12B5D781794166897B"]},{"type":"susecve","idList":["SUSECVE:CVE-2019-0230"]},{"type":"thn","idList":["THN:7FD924637D99697D78D53283817508DA"]},{"type":"threatpost","idList":["THREATPOST:0DD2AEA1738F9B6612B1C845F3BC949F"]},{"type":"ubuntucve","idList":["UB:CVE-2019-0230"]},{"type":"veracode","idList":["VERACODE:26331"]},{"type":"zdt","idList":["1337DAY-ID-35263","1337DAY-ID-35571"]}]},"exploitation":{"wildExploitedSources":[{"type":"attackerkb","idList":["AKB:289DC3CE-ED8A-4366-89F0-46E148584C36","AKB:CF76EF1F-CB59-4A29-ADB1-DA37C695142B"],"firstSeen":"2020-09-14T00:00:00"}],"wildExploited":true},"score":{"value":9.5,"uncertanity":0.2,"vector":"NONE"},"twitter":{"counter":3,"tweets":[{"link":"https://twitter.com/threatintelctr/status/1354962242668797959","text":" NEW: CVE-2019-0230  Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Severity: CRITICAL https://t.co/AVPlCba3Js?amp=1"},{"link":"https://twitter.com/ipssignatures/status/1344208104288907270","text":"The vuln CVE-2019-0230 has a tweet created 0 days ago and retweeted 10 times.\n/Dinosn/status/1314096930213986306\n/hashtag/pow1rtrtwwcve?src=hashtag_click"},{"link":"https://twitter.com/UK_Daniel_Card/status/1533201662944354306","text":"/hashtag/Atlassian?src=hashtag_click /hashtag/Confleunce?src=hashtag_click RCEs\n\nCVE-2022-26134 - OGNL Injection (/ root)\nCVE-2021-44228 (Log4Shell)\nCVE-2021-26084 - OGNL Injection (/ endpoint)\nCVE-2019-0230 (/rest/tinvmce/1/macro/preview)","author":"UK_Daniel_Card","author_photo":"https://pbs.twimg.com/profile_images/1334758434353319939/WOHgc0wO_400x400.jpg"}]},"backreferences":{"references":[{"type":"atlassian","idList":["ATLASSIAN:CONFSERVER-60189"]},{"type":"attackerkb","idList":["AKB:289DC3CE-ED8A-4366-89F0-46E148584C36"]},{"type":"cisa","idList":["CISA:3D9E69A26C68866B64ED6E4B31E270E6"]},{"type":"exploitdb","idList":["EDB-ID:49068"]},{"type":"github","idList":["GHSA-WP4H-PVGW-5727"]},{"type":"githubexploit","idList":["453574C2-C801-529D-A0A6-5C5E1471F1AC","4E339DB6-4704-5991-B690-DF8D7307532E","5E7409E5-7716-5F40-999C-E6622B806F5E","B1E738E0-BF1B-50E1-88E2-1D265CF9AEB8","BD05B538-25EA-5C42-AE8D-229D78B57CB1"]},{"type":"huawei","idList":["HUAWEI-SA-20200902-01-STRUTS2"]},{"type":"ibm","idList":["35DB525D4E07A09A6F2976ED4B93F380507E2F51F096B5749BE6E096C57DD8BD"]},{"type":"kitploit","idList":["KITPLOIT:5420210148456420402"]},{"type":"nessus","idList":["STRUTS_2_5_22.NASL"]},{"type":"openvas","idList":["OPENVAS:1361412562310883017"]},{"type":"oracle","idList":["ORACLE:CPUJAN2021"]},{"type":"packetstorm","idList":["PACKETSTORM:160108"]},{"type":"rapid7blog","idList":["RAPID7BLOG:5482AC1594C82A230828023816657B57"]},{"type":"redhatcve","idList":["RH:CVE-2019-0230"]},{"type":"saint","idList":["SAINT:1126B0AA9A8BD987E404F1746F1D8BFA","SAINT:AE1DA80E6B0E4C12B5D781794166897B"]},{"type":"thn","idList":["THN:7FD924637D99697D78D53283817508DA"]},{"type":"threatpost","idList":["THREATPOST:0DD2AEA1738F9B6612B1C845F3BC949F"]},{"type":"ubuntucve","idList":["UB:CVE-2019-0230"]},{"type":"zdt","idList":["1337DAY-ID-35263","1337DAY-ID-35571"]}]},"short_description":"Apache Struts 2.0.0 to 2.5.20 remote code execution vulnerabilit","tags":["cve-2019-0230","apache","struts","remote code execution","vulnerability","nvd"],"vulnersScore":9.5},"aiDescription":"CVE-2019-0230 affects Apache Struts 2.0.0–2.5.20 and is caused by forced double OGNL evaluation on raw user input in tag attributes, potentially enabling remote code execution. Reported impact is remote code execution with high severity (CVE CVSSv3 9.8). Mitigation documented in the sources includes upgrading to a fixed version (2.5.22 or later) or applying the described workaround via struts.xml and restarting Tomcat in specific environments (per the F5 advisory). Exploit-prone materials exist publicly (e.g., Exploit-DB and PoC repositories), indicating there are public proofs of concept/code for this vulnerability. Several connected advisories and community discussions corroborate the vulnerability’s existence and mitigation paths, with some sources noting DoS or RCE implications depending on the context. If applying in a live environment, verify exact versions and apply the upgrade to a non-vulnerable release; monitor for updates from vendor advisories.}","cpe":["cpe:/a:apache:struts::::"],"cpe23":["cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*"],"cwe":["CWE-1321"],"vulnStatus":"Modified","affectedSoftware":[{"cpeName":"apache:struts","version":"2.5.20","operator":"le","name":"apache struts"}],"affectedConfiguration":[],"cpeConfiguration":{},"cpeConfigurations":{"nvdCpeConfiguration":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"versionStartIncluding":"2.0.0","versionEndIncluding":"2.5.20","criteria":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.3:*:*:*:*:*:*:*"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.6:*:*:*:*:*:*:*"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:*"},{"vulnerable":true,"versionEndIncluding":"8.0.23","criteria":"cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*"}]}]}],"vulnersCpeConfiguration":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"versionStartIncluding":"2.0.0","versionEndIncluding":"2.5.20","criteria":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","provider":"apache"}]}]}],"_index":true},"extraReferences":[{"url":"https://cwiki.apache.org/confluence/display/ww/s2-059"},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html"},{"url":"https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html"},{"url":"https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E"},{"url":"http://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.html"},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html"},{"url":"http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html"},{"url":"https://launchpad.support.sap.com/#/notes/2982840"}],"cnaAffected":[{"product":"Apache Struts","vendor":"n/a","versions":[{"status":"affected","version":"Apache Struts 2.0.0 to 2.5.20"}]}],"cnaCpeApplicability":[],"solutions":[],"workarounds":[],"impacts":[],"exploits":[{"id":"1337DAY-ID-35263","href":"https://0day.today/exploit/description/35263","type":"zdt"},{"id":"1337DAY-ID-35571","href":"https://0day.today/exploit/description/35571","type":"zdt"},{"id":"453574C2-C801-529D-A0A6-5C5E1471F1AC","href":"https://github.com/tw-eason-tseng/CVE-2019-0230_Struts2S2-059","type":"githubexploit"},{"id":"4E339DB6-4704-5991-B690-DF8D7307532E","href":"https://github.com/Al1ex/CVE-2019-0230","type":"githubexploit"},{"id":"5E7409E5-7716-5F40-999C-E6622B806F5E","href":"https://github.com/BH2UOL/CVE-2019-0230","type":"githubexploit"},{"id":"B1E738E0-BF1B-50E1-88E2-1D265CF9AEB8","href":"https://github.com/fengziHK/CVE-2019-0230","type":"githubexploit"},{"id":"BD05B538-25EA-5C42-AE8D-229D78B57CB1","href":"https://github.com/f8al/CVE-2019-0230-PoC","type":"githubexploit"},{"id":"CVE-2019-0230","href":"http://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.html","type":"nvd"},{"id":"CVE-2019-0230","href":"http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html","type":"nvd"},{"id":"EDB-ID:49068","href":"https://www.exploit-db.com/exploits/49068","type":"exploitdb"},{"id":"MSF:EXPLOIT-MULTI-HTTP-STRUTS2_MULTI_EVAL_OGNL-","href":"https://www.rapid7.com/db/modules/exploit/multi/http/struts2_multi_eval_ognl/","type":"metasploit"},{"id":"PACKETSTORM:160108","href":"https://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.html","type":"packetstorm"},{"id":"PACKETSTORM:160721","href":"https://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html","type":"packetstorm"},{"id":"SAINT:1126B0AA9A8BD987E404F1746F1D8BFA","href":"https://my.saintcorporation.com/cgi-bin/exploit_info/struts_double_ognl","type":"saint"},{"id":"SAINT:891A42933A0DE986694E3B7D51B3F2F1","href":"https://download.saintcorporation.com/cgi-bin/exploit_info/struts_double_ognl","type":"saint"},{"id":"SAINT:AE1DA80E6B0E4C12B5D781794166897B","href":"http://download.saintcorporation.com/cgi-bin/exploit_info/struts_double_ognl","type":"saint"}],"problemTypes":[],"assigned":"2018-11-14T00:00:00","origin":"composite","threatData":{},"webApplicability":{"applicable":true,"vulnerabilities":[{"parameter":"c","url":"www.pentest.com/index.action","position":"query param","description":"CVE-2019-0230 remote code execution via OGNL evaluation in Apache Struts 2 when raw user input is evaluated in tag attributes.","cwe":["CWE-1321"]}]}}}}}