CVE-2019-0230 Apache Struts
| Affected software | Apache Struts |
|---|---|
| Severity | 9.8 Critical CVSS 3.1 2 scores |
| Fixed in | 2.5.22 |
| Weakness | CWE-1321 |
| Published | 14 Sep 2020 |
| Updated | 13 Nov 2026 |
Description
Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
CWE-915
Exploitation status
Exploited
Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV listed Exploitation reported in the wild. 1 citation · 3 exploits · earliest 2020-09-14.
- CISA Vulnrichment no assessment published
- Indexed PoC 7 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2020-08-13.
- EPSS 97% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2019-0230 in VulnCheck (free account).
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Reported exploitation | ess.coalitioninc.com | /cve?id=CVE-2019-0230 | 2020-09-14 |
| Exploit reference | VulnCheck XDB 7acfe7a4bf1e | Exploit type: initial-access | 2020-10-22 |
| Exploit reference | VulnCheck XDB b724ae055233 | Exploit type: initial-access | 2020-12-11 |
| Exploit reference | VulnCheck XDB dd2d4de8d593 | Exploit type: initial-access | 2023-12-21 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | CVE-2019-0230 & s2-059 poc. | 34 | 2020-08-20 |
| GitHub PoC | CVE-2019-0230 Exploit POC | 15 | 2020-08-13 |
| GitHub PoC | S2-059(CVE-2019-0230) | 9 | 2020-12-11 |
| GitHub PoC | PoC for apache struts 2 vuln cve-2019-0230 | 1 | 2020-10-22 |
| Exploit-DB | Apache Struts 2.5.20 - Double OGNL evaluation | 2020-11-17 | |
| Metasploit | Apache Struts 2 Forced Multi OGNL Evaluation (excellent rank) | ||
| Nuclei | Apache Struts <=2.5.20 - Remote Code Execution |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Process
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the ARMR Process rule. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: ARMR Process rule
Exploitation forks a process. Blocked by the Process rule in PROTECT mode.
Only stops attacks that start a program; an expression that reads files or data directly in Java is not stopped.
How to mitigate CVE-2019-0230
Upgrade Apache Struts to 2.5.22 or later. Until you can, Waratek RASP blocks exploitation with its process rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
9.8 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
CVSS
9.8 CRITICAL v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 2.0 | 7.5 | none | AV:N/AC:L/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update January 2021 ↗ | CPU | 2021-Q1 | Oracle Financial Services Applications / User Interface (Apache Struts) (8.0.3, 8.0.6) Oracle Financial Services Applications / User Interface (Apache Struts) (8.0.6) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Financial Services Applications | User Interface (Apache Struts) | 8.0.3, 8.0.6 | 8.0.3 · 8.0.6 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.struts:struts2-core |
2.0.0 | 2.5.22 |
unbounded |
Products and versions
6 products, 7 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | struts | generic | ≥ 2.0.0 and ≤ 2.5.20 |
| nvd | oracle | communications policy management | generic | 12.5.0 |
| nvd | oracle | financial services data integration hub | generic | 8.0.3 · 8.0.6 |
| nvd | oracle | financial services market risk measurement and management | generic | 8.0.6 |
| nvd | oracle | mysql enterprise monitor | generic | ≤ 8.0.23 |
| osv | org.apache.struts | struts2-core | generic | ≥ 2.0.0 and ＜ 2.5.22 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** HTTP, NO AUTH REMOTE EXPLOIT, USER INTERFACE (APACHE STRUTS) **Products:** STRUTS2, APACHE STRUTS 2, ORACLE FINANCIAL SERVICES APPLICATIONS
References
Timeline
Timeline
| Published | 2020-09-14 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2020-09-14 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| VulnCheck KEV: latest evidence | 2023-12-21 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |
| Last VRT activity | 2026-11-13 | Most recent commit touching this CVE's classification, patch or rule file. |