{"id":"CVE-2020-17530","details":"Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.","aliases":["GHSA-jc35-q369-45pv"],"modified":"2026-07-08T05:49:55.018609594Z","published":"2020-12-11T02:15:10.883Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*","cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*"],"extracted_events":[{"introduced":"12.2.1.3.0"},{"last_affected":"12.2.1.3.0"},{"introduced":"12.2.1.4.0"},{"last_affected":"12.2.1.4.0"}],"source":"CPE_STRING","vendor_product":"oracle:business_intelligence"},{"extracted_events":[{"introduced":"8.0.0"},{"last_affected":"8.0.0"},{"introduced":"8.1.0"},{"last_affected":"8.1.0"},{"introduced":"8.2.0"},{"last_affected":"8.2.0"},{"introduced":"8.2.3"},{"last_affected":"8.2.3"}],"source":"CPE_STRING","vendor_product":"oracle:communications_diameter_intelligence_hub","cpes":["cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.1.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.2.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.2.3:*:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.5.0"},{"last_affected":"12.5.0"}],"source":"CPE_STRING","vendor_product":"oracle:communications_policy_management"},{"extracted_events":[{"introduced":"12.0.0.3.0"},{"last_affected":"12.0.0.3.0"}],"source":"CPE_STRING","vendor_product":"oracle:communications_pricing_design_center","cpes":["cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0.3"},{"last_affected":"8.0.3"},{"introduced":"8.0.6"},{"last_affected":"8.0.6"}],"source":"CPE_STRING","vendor_product":"oracle:financial_services_data_integration_hub"},{"cpes":["cpe:2.3:a:oracle:hospitality_opera_5:5.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"5.6"},{"last_affected":"5.6"}],"source":"CPE_STRING","vendor_product":"oracle:hospitality_opera_5"},{"cpes":["cpe:2.3:a:oracle:mysql_enterprise_monitor:8.0.23:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0.23"},{"last_affected":"8.0.23"}],"source":"CPE_STRING","vendor_product":"oracle:mysql_enterprise_monitor"}]},"references":[{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-17530"},{"type":"ADVISORY","url":"http://jvn.jp/en/jp/JVN43969166/index.html"},{"type":"ADVISORY","url":"http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html"},{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2022/04/12/6"},{"type":"ADVISORY","url":"https://cwiki.apache.org/confluence/display/WW/S2-061"},{"type":"ADVISORY","url":"https://www.oracle.com/security-alerts/cpuapr2022.html"},{"type":"FIX","url":"https://security.netapp.com/advisory/ntap-20210115-0005/"},{"type":"FIX","url":"https://www.oracle.com//security-alerts/cpujul2021.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuApr2021.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpujan2021.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpujan2022.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuoct2021.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/struts","events":[{"introduced":"2c0a197cea8fdc7d8cda5eeaa15a1c76507ac0a5"},{"fixed":"e4db6b720e4d3e798d0741dfe8c1ef2289fef8b7"}],"database_specific":{"extracted_events":[{"introduced":"2.0.0"},{"fixed":"2.5.30"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-17530.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}