CVE-2020-17530
100Vexday Risk Score
Corrija agora. Ela está sob exploração confirmada pelo CISA e tem exploit funcional público.
ssvc Actcvss 9.8epss 96%
da publicação à arma0 dias
Publicada no NVD11 de dez.
1ª PoC9 de dez.
metasploit14 de set.
CISA KEV+327d
probabilidade de exploração
96%top 1% das CVEs
exploração observada
simCISA + VulnCheck
24 exploit(s) público(s)
Ação exigida pela CISAprazo federal: 2022-05-03
Apply updates per vendor instructions.
Versões
Afetadas
maven/org.apache.struts:struts2-core >= 2.0.0, < 2.5.26
Corrigidas em
maven/org.apache.struts:struts2-core 2.5.26
Pesquisado e redigido com IA a partir do advisory do fornecedor e de análises públicas, com as fontes acima. Confira sempre a versão corrigida no advisory oficial antes de agir.
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Apache Software Foundation · Apache StrutsPoCs públicas encontradas — 24
githubgithub.com/ka1n4t/CVE-2020-17530★ 64githubgithub.com/wuzuowei/CVE-2020-17530★ 46githubgithub.com/Al1ex/CVE-2020-17530★ 29githubgithub.com/fengziHK/CVE-2020-17530-strust2-061★ 7githubgithub.com/uzzzval/CVE-2020-17530★ 5githubgithub.com/CyborgSecurity/CVE-2020-17530★ 4githubgithub.com/secpool2000/CVE-2020-17530★ 1githubgithub.com/fatkz/CVE-2020-17530★ 0githubgithub.com/ludy-dev/freemarker_RCE_struts2_s2-061★ 0githubgithub.com/killmonday/CVE-2020-17530-s2-061★ 0githubgithub.com/keyuan15/CVE-2020-17530★ 0githubgithub.com/nth347/CVE-2020-17530★ 0githubgithub.com/shoucheng3/apache__struts_CVE-2020-17530_2-5-25★ 0vulncheckvulncheck.com/xdb/20acac973541não verificadovulncheckvulncheck.com/xdb/e3fa2afdc5f2não verificadovulncheckvulncheck.com/xdb/bfb08d5ee460não verificadovulncheckvulncheck.com/xdb/2413521dca63não verificadovulncheckvulncheck.com/xdb/dbd52a7e6d06não verificadovulncheckvulncheck.com/xdb/d5f1da1e2721não verificadovulncheckvulncheck.com/xdb/20d585ac92c4não verificadovulncheckvulncheck.com/xdb/e2133615d248não verificadovulncheckvulncheck.com/xdb/de8e0e425aa8não verificadovulncheckvulncheck.com/xdb/5fd88116c567não verificadocve_referencepacketstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.htmlnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
http://jvn.jp/en/jp/JVN43969166/index.htmlhttp://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.htmlhttps://cwiki.apache.org/confluence/display/WW/S2-061https://security.netapp.com/advisory/ntap-20210115-0005/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-17530https://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2021.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttp://www.openwall.com/lists/oss-security/2022/04/12/6