CVE-2020-17530 Apache Struts OGNL Injection | Qualys

Summary: A vulnerability tracked as CVE-2020-17530 in the OGNL evaluation function of Apache Struts versions 2.0.0 through 2.5.25 allows attackers to achieve remote code execution through double evaluation of tag attributes when an application is configured to force OGNL evaluation using %{..} syntax. Qualys Web Application Scanning added QID 150354, which sends a request with an OGNL RCE payload to confirm exploitability, and remediation is upgrading to Apache Struts 2.5.26 or greater.
Why it matters: Because the flaw depends on how the web application is configured, a simple Apache version check cannot identify vulnerable systems, and Qualys notes the RCE has been seen in the wild with multiple exploit scripts still being released.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2020-17530
Related: CVE-2020-17530: Apache Struts Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
Network Attack Trends: Internet of Threats (November 2020-January 2021) Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026