CVE-2019-0230

PoC ×2—

CVSS 3.1

9.8 critical

EPSS

97%p100

Published

Sep 14, 2020 (Sep 14, 2020)

Modified

Jun 17, 2026

Description

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

Vendors: apache oracle
Products: struts, communications policy management, financial services data integration hub, financial services market risk measurement and management, mysql enterprise monitor
Weakness: CWE-1321
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (97.4%)

In the news5 stories

Top 15 Vulnerabilities Attackers Exploited Millions of Times to Hack Linux Systems

The Hacker NewsAug 23, 13:27 UTC · Aug 23, 2021Vulnerability in the wildCVE-2017-5638 CVE-2017-9805 CVE-2018-7600+12 CVEs

60

Apache Software Foundation fixes code execution flaw in Apache Struts 2

Security AffairsDec 9, 07:36 UTC · Dec 9, 2020Exploit / PoC CVE-2020-17530 CVE-2019-02301

60

Week in review: Kali Linux 2020.3, mobile security threats, ISO certs at risk of lapsing

Help Net SecurityAug 23, 00:00 UTC · Aug 23, 2020Data breach CVE-2019-0230

60

Potential Apache Struts 2 RCE flaw fixed, PoCs released

Help Net SecurityAug 17, 00:00 UTC · Aug 17, 2020Vulnerability CVE-2019-0230 CVE-2019-0233 CVE-2018-11776+1 CVEs

60

PoC exploit code for two Apache Struts 2 flaws available online

Security AffairsAug 15, 15:53 UTC · Aug 15, 2020Exploit / PoC CVE-2019-0230 CVE-2019-0233 CVE-2017-5638

60