CVE-2020-17530
Remote code execution in Apache Struts
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
- Record
CVE-2020-17530- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-917
- Updated
- 2026-11-02
CVE List
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
- Record
CVE-2020-17530- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-917
- Updated
- 2026-11-02
EUVDEUVD-2022-1073
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
- Record
EUVD-2022-1073- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jc35-q369-45pv
Remote code execution in Apache Struts
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
- Record
GHSA-jc35-q369-45pv- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H - Weakness
- CWE-94, CWE-917
- Updated
- 2026-11-02
CISA KEV No score
Apache Struts Remote Code Execution Vulnerability
Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution.
- Record
CVE-2020-17530- Weakness
- CWE-917
- Updated
- 2026-11-02
OSV
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
- Record
CVE-2020-17530- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-jc35-q369-45pv
Remote code execution in Apache Struts
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
- Record
GHSA-jc35-q369-45pv- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H - Weakness
- CWE-917, CWE-94
- Updated
- 2026-11-02
Affected products
- apache struts
- apache software foundation struts
- oracle business intelligence
- oracle communications diameter intelligence hub
- oracle communications policy management
- oracle communications pricing design center
- oracle financial services data integration hub
- oracle hospitality opera 5
- oracle mysql enterprise monitor
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts:struts2-coreMaven |
2.0.0 up to 2.5.26 | 2.5.26 |
org.apache.struts:struts2-coreMaven |
2.0.0 up to 2.5.26, plus listed versions 2.0.112.0.11.12.0.11.22.0.122.0.14 Show 45 moreShow less2.0.52.0.62.0.82.0.92.1.22.1.62.1.82.1.8.12.2.12.2.1.12.2.32.2.3.12.3.12.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.15.22.3.15.32.3.162.3.16.12.3.16.22.3.16.32.3.202.3.20.12.3.20.32.3.242.3.24.12.3.24.32.3.282.3.28.12.3.292.3.32.3.302.3.312.3.322.3.332.3.342.3.352.3.36 |
2.5.26 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Apache Struts 2 Forced Multi OGNL Evaluation | 2020-09-14 |
| PoC in GitHub | ka1n4t/CVE-2020-17530 | 2020-12-09 |
| PoC in GitHub | secpool2000/CVE-2020-17530 | 2020-12-09 |
| PoC in GitHub | wuzuowei/CVE-2020-17530 | 2020-12-10 |
| PoC in GitHub | Al1ex/CVE-2020-17530 | 2020-12-13 |
| PoC in GitHub | fengziHK/CVE-2020-17530-strust2-061 | 2020-12-14 |
| PoC in GitHub | ludy-dev/freemarker_RCE_struts2_s2-061 | 2020-12-18 |
| PoC in GitHub | CyborgSecurity/CVE-2020-17530 | 2020-12-30 |
| PoC in GitHub | uzzzval/CVE-2020-17530 | 2021-01-07 |
| PoC in GitHub | killmonday/CVE-2020-17530-s2-061 | 2021-01-24 |
Show 4 moreShow less
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | keyuan15/CVE-2020-17530 | 2023-04-02 |
| PoC in GitHub | nth347/struts2-CVE-2020-17530 | 2023-08-04 |
| PoC in GitHub | fatkz/CVE-2020-17530 | 2025-05-14 |
| Nuclei | Apache Struts 2.0.0-2.5.25 - Remote Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-17530 is a critical vulnerability (CVSS 9.8) in Apache Struts, published December 11, 2020. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 96.3%, the 99th percentile. Fixed in org.apache.struts:struts2-core 2.5.26.
References
cwiki.apache.org/confluence/display/WW/S2-061
jvn.jp/en/jp/JVN43969166/index.html
oracle.com/security-alerts/cpujan2021.html
packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html
security.netapp.com/advisory/ntap-20210115-0005
Show 9 moreShow less
openwall.com/lists/oss-security/2022/04/12/6
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-17530
nvd.nist.gov/vuln/detail/CVE-2020-17530
github.com/advisories/GHSA-jc35-q369-45pv
Left out here: 25 versions. The JSON record has them.