Количество 6
Количество 6
CVE-2021-31805
The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.
CVE-2021-31805
The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.
CVE-2021-31805
The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.
CVE-2021-31805
The fix issued for CVE-2020-17530 was incomplete. So from Apache Strut ...
GHSA-v8j6-6c2r-r27c
Expression Language Injection in Apache Struts
BDU:2022-02726
Уязвимость программной платформы Apache Struts, существующая из-за некорректной обработки выражений Object Graph Navigation Language, позволяющая нарушителю выполнить произвольный код
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2021-31805 The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation. | CVSS3: 9.8 | 85% Высокий | больше 4 лет назад |
 | CVE-2021-31805 The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation. | CVSS3: 8.1 | 85% Высокий | больше 4 лет назад |
 | CVE-2021-31805 The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation. | CVSS3: 9.8 | 85% Высокий | больше 4 лет назад |
| CVE-2021-31805 The fix issued for CVE-2020-17530 was incomplete. So from Apache Strut ... | CVSS3: 9.8 | 85% Высокий | больше 4 лет назад |
| GHSA-v8j6-6c2r-r27c Expression Language Injection in Apache Struts | CVSS3: 9.8 | 85% Высокий | больше 4 лет назад |
 | BDU:2022-02726 Уязвимость программной платформы Apache Struts, существующая из-за некорректной обработки выражений Object Graph Navigation Language, позволяющая нарушителю выполнить произвольный код | CVSS3: 9.8 | 85% Высокий | больше 4 лет назад |
Уязвимостей на страницу