{"action":"Upgrade org.apache.struts:struts2-core to 2.5.26 or later.","affected":[{"fixed":"2.5.26","introduced":"2.0.0"}],"component":"org.apache.struts:struts2-core","cve_ids":["CVE-2020-17530"],"ecosystem":"Maven","epss":0.96251,"exploited":true,"fixed_versions":["2.5.26"],"ghsa_id":"GHSA-jc35-q369-45pv","id":"tcs_01M5N92JBCMT7XFTWT5SKS5537","modified_at":"2025-10-22T19:30:33.939058Z","published_at":"2022-02-09T22:51:56Z","references":["https://osv.dev/vulnerability/GHSA-jc35-q369-45pv","https://nvd.nist.gov/vuln/detail/CVE-2020-17530","https://cwiki.apache.org/confluence/display/WW/S2-061","https://github.com/apache/struts","https://security.netapp.com/advisory/ntap-20210115-0005","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-17530","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","http://jvn.jp/en/jp/JVN43969166/index.html","http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html","http://www.openwall.com/lists/oss-security/2022/04/12/6"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-jc35-q369-45pv","url":"https://osv.dev/vulnerability/GHSA-jc35-q369-45pv"},{"source":"kev","source_id":"CVE-2020-17530","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}],"summary":"Remote code execution in Apache Struts"}