Attacker Value
Very High
CVE-2020-17530
CVE-2020-17530
(Last updated November 28, 2024) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Metasploit Module
Description
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 – Struts 2.5.25.
Add Assessment
2
Technical Analysis
See my assessment on CVE-2019-0230. Apache themselves said this is similar to S2-059.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
9.8 Critical
Impact Score:
5.9
Exploitability Score:
3.9
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High
General Information
Vendors
- apache,
- oracle
Products
- business intelligence 12.2.1.3.0,
- business intelligence 12.2.1.4.0,
- communications diameter intelligence hub 8.0.0,
- communications diameter intelligence hub 8.1.0,
- communications diameter intelligence hub 8.2.0,
- communications diameter intelligence hub 8.2.3,
- communications policy management 12.5.0,
- communications pricing design center 12.0.0.3.0,
- financial services data integration hub 8.0.3,
- financial services data integration hub 8.0.6,
- hospitality opera 5 5.6,
- mysql enterprise monitor 8.0.23,
- struts
Metasploit Modules
References
Advisory
Related AttackerKB Topic
Miscellaneous
