CVE-2019-0230: apache struts Prototype Pollution

CVSS: 9.8v3.1CriticalModified

AliasesGHSA-wp4h-pvgw-5727

Published 14-09-2020Last modified 04-08-2024

Vulnerability summary

CVE-2019-0230 is a critical (CVSS 9.8) Prototype Pollution vulnerability in apache struts. EPSS estimates a 96.95% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 4 public exploits are recorded.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.1 (NVD)

EPSS score

96.95%

0%100%

Critical · -0.45 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits4reference, exploit-database, metasploit

Timeline

14-09-2020
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.19.8v2.07.5

EPSS trend

Probability

96.95%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

-0.45 pp

From 97.40% on 19-09-2026

19-09-202619-10-2026

EPSS score

96.95%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

4 found

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
exploit-databaseremotemultipleUnverified
Apache Struts 2.5.20 - Double OGNL evaluation
Maturity: poc

Show all 4 exploits

MetasploitremoteVerified
Apache Struts 2 Forced Multi OGNL Evaluation
exploit/multi/http/struts2_multi_eval_ognl
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Affected systems

Oracle4 products

communications_policy_management12.5.0
financial_services_data_integration_hub8.0.3 | 8.0.6
financial_services_market_risk_measurement_and_management8.0.6
mysql_enterprise_monitor≤ 8.0.23

Apache1 product

struts≥ 2.0.0, ≤ 2.5.20

Org.apache.struts1 product

struts2-core≥ 2.0.0, < 2.5.22

3 vendors · 6 products

References

13 links

cwiki.apache.org/confluence/display/ww/s2-059X Refsource MISCVendor AdvisoryWEB
www.oracle.com/security-alerts/cpujan2021.htmlX Refsource MISCPatchThird Party AdvisoryWEB
packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.htmlX Refsource MISCExploitThird Party AdvisoryVDB EntryWEB
launchpad.support.sap.comX Refsource MISCPermissions RequiredWEB
packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.htmlX Refsource MISCExploitThird Party AdvisoryVDB EntryWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
www.oracle.com/security-alerts/cpuApr2021.htmlX Refsource MISCPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuoct2021.htmlX Refsource MISCPatchThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2019-0230Advisory

Show all 13 references

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities