CVE-2019-0230

Katalog CVE

CVSS 9.8 · Critical EPSS 96,9%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada apache struts, oracle communications policy management +3 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

Rincian

Terbit di NVD

14 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

96,9% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cwiki.apache.org/confluence/display/ww/s2-059 advisory vendor
• https://www.oracle.com/security-alerts/cpuApr2021.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujan2021.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuoct2021.html patch · advisory pihak ketiga
• http://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.html exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html exploit · advisory pihak ketiga · vdb entry
• https://launchpad.support.sap.com/#/notes/2982840 permissions required
• https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.a...
• https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.a...