{"id":"CVE-2019-0230","aliases":["GHSA-wp4h-pvgw-5727"],"url":"https://o3.security/vulnerability/CVE-2019-0230","summary":"Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts","details":"Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.","published":"2020-09-14T17:15:09.933Z","modified":"2026-07-08T05:53:21.177524120Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.97112,"percentile":0.99887,"asOf":"2026-08-27"},"cisaKev":null,"exploitsKnown":12,"affectedPackages":[{"ecosystem":"Maven","name":"org.apache.struts:struts2-core","fixedVersion":"2.5.22"}],"fix":null,"references":[{"type":"WEB","url":"https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E"},{"type":"ADVISORY","url":"https://cwiki.apache.org/confluence/display/ww/s2-059"},{"type":"REPORT","url":"https://launchpad.support.sap.com/#/notes/2982840"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuApr2021.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpujan2021.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuoct2021.html"},{"type":"EVIDENCE","url":"http://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.html"},{"type":"EVIDENCE","url":"http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T05:53:21.177524120Z"}}