CVE-2020-17530: apache struts +7 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2020-17530

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 95,9%

Kerentanan Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') pada apache struts, oracle business intelligence +6 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 3 November 2021, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.

Rincian

Terbit di NVD: 11 Desember 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
EPSS (30 hari): 95,9% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Apache Struts Remote Code Execution Vulnerability
Masuk KEV: 3 November 2021
Tenggat CISA: 3 Mei 2022 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
apache	struts	Versi 2.0.0 hingga sebelum 2.5.30
oracle	business intelligence	Versi 12.2.1.3.0
oracle	business intelligence	Versi 12.2.1.4.0
oracle	communications diameter intelligence hub	Versi 8.0.0
oracle	communications diameter intelligence hub	Versi 8.1.0
oracle	communications diameter intelligence hub	Versi 8.2.0
oracle	communications diameter intelligence hub	Versi 8.2.3
oracle	communications policy management	Versi 12.5.0
oracle	communications pricing design center	Versi 12.0.0.3.0
oracle	financial services data integration hub	Versi 8.0.3
oracle	financial services data integration hub	Versi 8.0.6
oracle	hospitality opera 5	Versi 5.6
oracle	mysql enterprise monitor	Versi 8.0.23

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://cwiki.apache.org/confluence/display/WW/S2-061 advisory vendor
https://security.netapp.com/advisory/ntap-20210115-0005/ patch · advisory pihak ketiga
https://www.oracle.com//security-alerts/cpujul2021.html patch · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpuApr2021.html patch · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpujan2021.html patch · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpuoct2021.html patch · advisory pihak ketiga
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-17530 pemerintah AS
http://jvn.jp/en/jp/JVN43969166/index.html advisory pihak ketiga
http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html advisory pihak ketiga · vdb entry
http://www.openwall.com/lists/oss-security/2022/04/12/6 mailing list · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpuapr2022.html advisory pihak ketiga

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.