CVE-2020-17530VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2020-17530: Apache Struts Remote Code Execution Vulnerability

Affects Apache StrutsSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
EPSS: 95.9% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2020-17530 (opens in a new tab)

Description

CVE-2020-17530 is a high-severity remote code execution vulnerability in Apache Struts. It arises from forced evaluation of Object-Graph Navigation Language (OGNL) expressions on raw user input within tag attributes. This flaw allows attackers to execute arbitrary code remotely. Exploitation of this vulnerability has been observed in the wild.

Summary

Apache Struts contains a vulnerability identified as CVE-2020-17530, where forced evaluation of OGNL expressions on untrusted user input in tag attributes can lead to remote code execution. This occurs because the framework evaluates OGNL expressions without sufficient validation or sanitization, enabling attackers to inject malicious code. The vulnerability has been exploited in real-world attacks, indicating active threat presence.

Impact

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code on affected Apache Struts servers. This can lead to full system compromise, data breaches, and disruption of services. The vulnerability is considered high severity due to the potential for remote code execution and observed exploitation in the wild.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is confirmed, users should monitor Apache Struts advisories for patches addressing CVE-2020-17530 and apply them promptly once available. No vendor advisory content or patch links are currently provided.

Weaknesses

CWE-917Expression Language Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:41:45 UTC

Weaknesses

References

Related threats