NetSight
IP …
critical9.8Public exploit code

CVE-2019-0230

Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.struts:struts2-core>= 2.0.0, < 2.5.222.5.22

Affected products

VendorProductAffected versions
ApacheStruts
from 2.0.0 through 2.5.20
OracleCommunications Policy Management
Version 12.5.0
OracleFinancial Services Data Integration Hub
Versions 8.0.3, 8.0.6
OracleFinancial Services Market Risk Measurement And Management
Version 8.0.6
OracleMysql Enterprise Monitor
through 8.0.23

Weakness classification

CWE-1321CWE-915

References