The vulnerability of the Apache Struts software framework arises from incorrect processing of Object Graph Navigation Language expressions, allowing attackers to execute arbitrary code.

🗓️ 28 Apr 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Apache Struts vulnerability from improper OGNL processing enables arbitrary code execution via crafted requests.

Reporter	Title	Published	Views	Family All 53
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities	8 Nov 202216:20	–	ibm
IBM Security Bulletins	Security Bulletin: CVE-2021-31805 may affect Apache Struts used by Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections	9 Jun 202207:32	–	ibm
IBM Security Bulletins	Security Bulletin: Order Management could be subject to an Apache Struts vulnerability that could allow a remote attacker to execute arbitrary code on the system.	12 Apr 202417:44	–	ibm
IBM Security Bulletins	Security Bulletin: CVE-2021-31805 may affect Apache Struts used by Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections	9 Jun 202208:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Apache Struts Affect IBM eDiscovery Manager	12 Jul 202310:00	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Struts affect IBM Tivoli Application Dependency Discovery Manager. (CVE-2021-31805)	18 Nov 202212:11	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Struts library affect Tivoli Netcool/OMNIbus WebGUI (CVE-2021-31805)	27 Jun 202203:47	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insight v1.6.6 contains fixes for multiple security vulnerabilities.	25 Oct 202213:11	–	ibm
IBM Security Bulletins	Security Bulletin: CVE-2021-31805 may affect Apache Struts used by Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections	9 Jun 202208:06	–	ibm
IBM Security Bulletins	Security Bulletin: CVE-2021-31805 may affect Apache Struts used by Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections	9 Jun 202208:07	–	ibm

Vulners

Node

apache strutsRange<2.5.30

Source	Link
cwiki	www.cwiki.apache.org/confluence/display/WW/S2-062
cybersecurity-help	www.cybersecurity-help.cz/vdb/SB2022041218
openwall	www.openwall.com/lists/oss-security/2022/04/12/6
github	www.github.com/Wrin9/CVE-2021-31805
web	www.web.nvd.nist.gov/view/vuln/detail

28 Apr 2022 00:00Current

7.9High risk

Vulners AI Score7.9

CVSS 39.8

CVSS 210

EPSS0.85315

struts vulnerability object graph navigation arbitrary code execution crafted requests