Non notée
CVE-2021-31805 The fix issued for CVE-2020-17530 was incomplete
Description
The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Struts | Versions non publiées |
Autres CVE de Apache Struts
Les 33 CVE de Apache Struts →
CVE-2026-104714
Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache…
Non notée
CVE-2026-104713
Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin
Non notée
CVE-2026-104712
Asymmetric resource consumption (amplification) vulnerability in Apache Struts
Non notée
CVE-2026-104711
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection')…
Non notée