Remote code execution in Apache Struts

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

Vulnerability ID: GHSA-jc35-q369-45pv
Aliases: CVE-2020-17530
Published: 2022-02-09 22:51:56
CWE: CWE-917
CWE-94
Severity rating: CRITICAL
CVSS: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven
name: org.apache.struts:struts2-core