CVE-2019-0230

Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts

9.8 CriticalPublic exploitFix available

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

96.9%Up 18.1 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

Record: CVE-2019-0230
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-1321
Updated: 2026-11-02

CVE List No score

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

Record: CVE-2019-0230
Updated: 2026-11-02

EUVDEUVD-2021-2606 No score

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

Record: EUVD-2021-2606
Updated: 2026-11-03

GitHub AdvisoriesGHSA-wp4h-pvgw-5727 9.8

Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

Record: GHSA-wp4h-pvgw-5727
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-915, CWE-1321
Updated: 2026-11-02

OSV 9.8

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

Record: CVE-2019-0230
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-wp4h-pvgw-5727 9.8

Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

Record: GHSA-wp4h-pvgw-5727
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1321, CWE-915
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.struts:struts2-core` Maven	2.0.0 up to 2.5.22	2.5.22
`org.apache.struts:struts2-core` Maven	2.0.0 up to 2.5.22, plus listed versions 2.0.112.0.11.12.0.11.22.0.122.0.14 Show 45 moreShow less 2.0.52.0.62.0.82.0.92.1.22.1.62.1.82.1.8.12.2.12.2.1.12.2.32.2.3.12.3.12.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.15.22.3.15.32.3.162.3.16.12.3.16.22.3.16.32.3.202.3.20.12.3.20.32.3.242.3.24.12.3.24.32.3.282.3.28.12.3.292.3.32.3.302.3.312.3.322.3.332.3.342.3.352.3.36	2.5.22

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Apache Struts 2.5.20 - Double OGNL evaluation	2020-11-17
Metasploit	Apache Struts 2 Forced Multi OGNL Evaluation	2020-09-14
Nuclei	Apache Struts <=2.5.20 - Remote Code Execution
PoC in GitHub	Al1ex/CVE-2019-0230	2020-12-11
PoC in GitHub	PrinceFPF/CVE-2019-0230	2020-08-13
PoC in GitHub	f8al/CVE-2019-0230-PoC	2020-10-22
PoC in GitHub	ramoncjs3/CVE-2019-0230	2020-08-20

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, products	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-0230 is a critical vulnerability (CVSS 9.8) in Apache Struts, published September 14, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 96.9%, the 99th percentile. Fixed in org.apache.struts:struts2-core 2.5.22.

References

Show 8 moreShow less

This page doesn't list everything

Left out here: 23 versions. The JSON record has them.