The vulnerability of the Apache Struts software platform arises from incorrect processing of Object Graph Navigation Language expressions, allowing attackers to execute arbitrary code.

🗓️ 23 Feb 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 6 Views

The Apache Struts vulnerability allows remote code execution via Object Graph Navigation Language processing errors.

Reporter	Title	Published	Views	Family All 91
IBM Security Bulletins	Security Bulletin: Order Management could be subject to an Apache Struts vulnerability that could allow a remote attacker to execute arbitrary code on the system.	12 Apr 202417:44	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Struts framework affects IBM Spectrum Symphony	19 Mar 202109:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities is affecting Tivoli Netcool/OMNIbus WebGUI (CVE-2021-20336, CVE-2020-17530)	22 Mar 202113:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Call Center and Apache Struts Struts upgrade strategy (various CVEs, see below)	14 Sep 202217:37	–	ibm
IBM Security Bulletins	Security Bulletin: CVE-2020-17530 may affect Apache struts2-core used by Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections	9 Jun 202208:00	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Struts affects IBM Tivoli Application Dependency Discovery Manager (CVE-2020-17530)	13 Apr 202212:25	–	ibm
IBM Security Bulletins	Security Bulletin: CVE-2020-17530 may affect Apache struts2-core used by Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections	9 Jun 202208:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Apache Struts Affect IBM eDiscovery Manager	12 Jul 202310:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Order Management Apache Struts upgrade strategy (various CVEs, see below)	14 Sep 202217:45	–	ibm
IBM Security Bulletins	Security Bulletin: CVE-2020-17530 may affect Apache struts2-core used by Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections	9 Jun 202208:01	–	ibm

Vulners

Node

oracle business_intelligence_enterprise_editionMatch12.2.1.3.0

OR

oracle business_intelligence_enterprise_editionMatch12.2.1.4.0

OR

oracle oracle_financial_services_market_risk_measurement_and_managementMatch8.0.6

OR

oracle oracle_financial_services_data_integration_hubMatch8.0.6

OR

apache strutsRange2.0.0–2.5.25

OR

oracle oracle_financial_services_data_integration_hubMatch8.0.3

OR

oracle hospitality_opera_5Match5.6

OR

oracle oracle_communications_policy_managementMatch12.5.0

OR

oracle oracle_communications_pricing_design_centerMatch12.0.0.3.0

OR

oracle mysql_enterprise_monitorRange≤8.0.23

Source	Link
jvn	www.jvn.jp/en/jp/JVN43969166/index.html
packetstormsecurity	www.packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html
cwiki	www.cwiki.apache.org/confluence/display/WW/S2-061
security	www.security.netapp.com/advisory/ntap-20210115-0005/
oracle	www.oracle.com//security-alerts/cpujul2021.html
oracle	www.oracle.com/security-alerts/cpuApr2021.html
oracle	www.oracle.com/security-alerts/cpujan2021.html
oracle	www.oracle.com/security-alerts/cpujan2022.html
oracle	www.oracle.com/security-alerts/cpuoct2021.html
cisa	www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv

24 Sep 2024 00:00Current

7.6High risk

Vulners AI Score7.6

CVSS 39.8

CVSS 210

EPSS0.95922

Apache Struts Object Graph Navigation Language Remote code execution Processing errors