Description
Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a Apache Struts
Apache Struts 2.0.0 to 2.5.20affected
References
- https://cwiki.apache.org/confluence/display/ww/s2-059 ↗
- https://www.oracle.com/security-alerts/cpujan2021.html ↗
- http://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.html ↗
- https://launchpad.support.sap.com/#/notes/2982840 ↗
- http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html ↗
- https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E ↗
- https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E ↗
- https://www.oracle.com/security-alerts/cpuApr2021.html ↗
- https://www.oracle.com/security-alerts/cpuoct2021.html ↗