Skip to main content

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

CVE-2020-17530

High
9.8/10

Summary

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software: Apache Struts 2.0.0 through 2.5.25.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-917 - Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

The software constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

References

Advisory Timeline

  • Published