{"containers": {"cna": {"affected": [{"product": "Apache Struts", "vendor": "Apache Software Foundation", "versions": [{"status": "affected", "version": "2.0.0 to 2.5.29"}]}], "credits": [{"lang": "en", "value": "Apache Struts would like to thank Chris McCown for reporting this issue!"}], "descriptions": [{"lang": "en", "value": "The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag\u2019s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-917", "description": "CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-07-25T16:27:57", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://cwiki.apache.org/confluence/display/WW/S2-062"}, {"name": "[oss-security] 20220412 CVE-2021-31805: Apache Struts: Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2022/04/12/6"}, {"tags": ["x_refsource_MISC"], "url": "https://www.oracle.com/security-alerts/cpujul2022.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://security.netapp.com/advisory/ntap-20220420-0001/"}], "source": {"discovery": "UNKNOWN"}, "title": "Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.", "workarounds": [{"lang": "en", "value": "Avoid using forced OGNL evaluation on untrusted user input, and/or upgrade to Struts 2.5.30 which checks if expression evaluation won\u2019t lead to the double evaluation.\n\nPlease read our Security Bulletin S2-062 for more details."}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@apache.org", "ID": "CVE-2021-31805", "STATE": "PUBLIC", "TITLE": "Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE."}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Apache Struts", "version": {"version_data": [{"version_value": "2.0.0 to 2.5.29"}]}}]}, "vendor_name": "Apache Software Foundation"}]}}, "credit": [{"lang": "eng", "value": "Apache Struts would like to thank Chris McCown for reporting this issue!"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag\u2019s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": [{}], "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')"}]}]}, "references": {"reference_data": [{"name": "https://cwiki.apache.org/confluence/display/WW/S2-062", "refsource": "MISC", "url": "https://cwiki.apache.org/confluence/display/WW/S2-062"}, {"name": "[oss-security] 20220412 CVE-2021-31805: Apache Struts: Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2022/04/12/6"}, {"name": "https://www.oracle.com/security-alerts/cpujul2022.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpujul2022.html"}, {"name": "https://security.netapp.com/advisory/ntap-20220420-0001/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20220420-0001/"}]}, "source": {"discovery": "UNKNOWN"}, "work_around": [{"lang": "en", "value": "Avoid using forced OGNL evaluation on untrusted user input, and/or upgrade to Struts 2.5.30 which checks if expression evaluation won\u2019t lead to the double evaluation.\n\nPlease read our Security Bulletin S2-062 for more details."}]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T23:10:30.193Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://cwiki.apache.org/confluence/display/WW/S2-062"}, {"name": "[oss-security] 20220412 CVE-2021-31805: Apache Struts: Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2022/04/12/6"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.oracle.com/security-alerts/cpujul2022.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://security.netapp.com/advisory/ntap-20220420-0001/"}]}]}, "cveMetadata": {"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2021-31805", "datePublished": "2022-04-12T15:25:11", "dateReserved": "2021-04-26T00:00:00", "dateUpdated": "2024-08-03T23:10:30.193Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*", "matchCriteriaId": "24A8DF7C-82D9-4D56-AAE7-5D1DEB1CD558", "versionEndIncluding": "2.5.29", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag\u2019s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation."}, {"lang": "es", "value": "La correcci\u00f3n emitida para CVE-2020-17530 era incompleta. As\u00ed, desde Apache Struts versiones 2.0.0 hasta 2.5.29, todav\u00eda algunos de los atributos de las etiquetas pod\u00edan llevar a cabo una doble evaluaci\u00f3n si un desarrollador aplicaba la evaluaci\u00f3n OGNL forzada usando la sintaxis %{...}. El uso de la evaluaci\u00f3n forzada de OGNL en entradas de usuario no confiables puede conllevar a una Ejecuci\u00f3n de C\u00f3digo Remota y una degradaci\u00f3n de la seguridad"}], "id": "CVE-2021-31805", "lastModified": "2022-07-25T18:15:43.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-04-12T16:15:08.133", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Mitigation", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/04/12/6"}, {"source": "security@apache.org", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://cwiki.apache.org/confluence/display/WW/S2-062"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20220420-0001/"}, {"source": "security@apache.org", "url": "https://www.oracle.com/security-alerts/cpujul2022.html"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-917"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-917"}], "source": "security@apache.org", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank Chris McCown for reporting this issue.", "bugzilla": {"description": "Struts: Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.", "id": "2074788", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2074788"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-917", "details": ["The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag\u2019s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation."], "name": "CVE-2021-31805", "package_state": [{"cpe": "cpe:/a:redhat:jboss_fuse:6", "fix_state": "Not affected", "package_name": "struts", "product_name": "Red Hat JBoss Fuse 6"}, {"cpe": "cpe:/a:redhat:jboss_fuse_service_works:6", "fix_state": "Not affected", "package_name": "struts", "product_name": "Red Hat JBoss Fuse Service Works 6"}, {"cpe": "cpe:/a:redhat:jboss_operations_network:3", "fix_state": "Not affected", "package_name": "struts", "product_name": "Red Hat JBoss Operations Network 3"}], "public_date": "2022-04-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-31805\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-31805"], "statement": "Apache Struts2 is not compiled, shipped, used, or enabled in Red Hat products. As such, any CVE against Apache Struts2 does not impact currently supported Red Hat products.\nThis statement was last revised on 1 Sept 2020.\nPrevious statement example: https://bugzilla.redhat.com/show_bug.cgi?id=1469265", "threat_severity": "Important", "upstream_fix": "Struts 2.5.30"}