CVE-2021-31805 Apache Struts
| Affected software | Apache Struts |
|---|---|
| Severity | 9.8 Critical CVSS 3.1 2 scores |
| Fixed in | 2.5.30 |
| Weakness | Expression language injection (CWE-917) |
| Published | 12 Apr 2022 |
| Updated | 13 Nov 2026 |
Description
The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.
Exploitation status
Exploited
Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV listed Exploitation reported in the wild. 4 citations · honeypot sightings · 6 exploits · earliest 2022-05-11.
- CISA Vulnrichment no assessment published
- Indexed PoC 9 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2022-04-15.
- EPSS 85% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.7% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2021-31805 in VulnCheck (free account), which lists 1 more exploit reference not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | VulnCheck canaries | Exploitation attempts seen on 1 day | 2026-11-12 |
| Reported exploitation | blog.netlab.360.com | /public-cloud-threat-intelligence-202204 | 2022-05-11 |
| Reported exploitation | media.kasperskycontenthub.com | /wp-content/uploads/sites/43/2023/11/09055246/Modern-Asian-APT-groups-TTPs_report_eng.pdf | 2023-11-09 |
| Reported exploitation | veriti.ai | /blog/vulnerable-villain-when-hackers-get-hacked | 2024-04-15 |
| Reported exploitation | previdian.com | /CVE-2021-31805 | 2026-06-12 |
| Exploit reference | VulnCheck XDB 093ed7b6c682 | Exploit type: initial-access | 2022-04-15 |
| Exploit reference | VulnCheck XDB 36ffb3b771ea | Exploit type: initial-access | 2022-04-15 |
| Exploit reference | VulnCheck XDB d2fdeaa69784 | Exploit type: initial-access | 2022-04-15 |
| Exploit reference | VulnCheck XDB cb89472f97e9 | Exploit type: initial-access | 2022-04-26 |
| Exploit reference | VulnCheck XDB 61bff6d74e54 | Exploit type: initial-access | 2023-12-21 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | 远程代码执行S2-062 CVE-2021-31805验证POC | 131 | 2022-04-15 |
| GitHub PoC | S2-062 (CVE-2021-31805) / S2-061 / S2-059 RCE | 37 | 2022-04-15 |
| GitHub PoC | Apache Struts2 S2-062远程代码执行漏洞(CVE-2021-31805) 支持批量扫描漏洞及漏洞利用 | 23 | 2022-04-15 |
| GitHub PoC | Apache Struts2 S2-062远程代码执行漏洞(CVE-2021-31805) | 反弹Shell | 11 | 2022-04-15 |
| GitHub PoC | S2-061/S2-062 Struts2 远程命令执行漏洞 POC&EXP | 5 | 2022-07-10 |
| GitHub PoC | PoC for CVE-2021-31805 (Apache Struts2) | 5 | 2022-04-15 |
| GitHub PoC | Apache Struts2 S2-062(CVE-2021-31805)远程代码执行批量检测（无利用） | 1 | 2022-04-18 |
| GitHub PoC | Vulnerable environment of CVE-2021-31805 (S2-062) for testing | 2023-08-04 | |
| Nuclei | Apache Struts2 S2-062 - Remote Code Execution |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Process
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the ARMR Process rule. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: ARMR Process rule
Exploitation forks a process. Blocked by the Process rule in PROTECT mode.
Only stops attacks that start a program; an expression that reads files or data directly in Java is not stopped.
The Marshal rule does not apply: rce() arms only inside a deserialization boundary.
How to mitigate CVE-2021-31805
Upgrade Apache Struts to 2.5.30 or later. Until you can, Waratek RASP blocks exploitation with its process rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
9.8 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
CVSS
9.8 CRITICAL v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 2.0 | 7.5 | none | AV:N/AC:L/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Security Patch Update August 2026 ↗ | CSPU | 2026-Q3 | Oracle Hyperion / Common Events (Apache Struts 1) (11.2.25.0.000) |
| Oracle Critical Patch Update January 2023 ↗ | CPU | 2023-Q1 | Oracle Hyperion / Installation and Configuration (Apache Struts) (11.2.10) |
| Oracle Critical Patch Update October 2022 ↗ | CPU | 2022-Q4 | Oracle Communications / Configuration Management Platform (Apache Struts) (12.6.0.0.0) |
| Oracle Critical Patch Update July 2022 ↗ | CPU | 2022-Q3 | Oracle Hospitality Applications / Login (Apache Struts) (5.6) Oracle MySQL / Monitoring: General (Apache Struts) (8.0.30 and prior) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications | Configuration Management Platform (Apache Struts) | 12.6.0.0.0 | 12.6.0.0.0 |
| Oracle Hospitality Applications | Login (Apache Struts) | 5.6 | 5.6 |
| Oracle Hyperion | Common Events (Apache Struts 1) | 11.2.25.0.000 | 11.2.25.0.0 |
| Oracle Hyperion | Installation and Configuration (Apache Struts) | 11.2.10 | 11.2.10 |
| Oracle MySQL | Monitoring: General (Apache Struts) | 8.0.30 and prior |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.struts:struts2-core |
2.0.0 | 2.5.30 |
unbounded |
Products and versions
2 products, 2 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | struts | generic | ≥ 2.0.0 and ≤ 2.5.29 |
| osv | org.apache.struts | struts2-core | generic | ≥ 2.0.0 and ＜ 2.5.30 |
References
Timeline
Timeline
| Published | 2022-04-12 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2022-05-11 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| VulnCheck KEV: latest evidence | 2026-11-12 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |
| Last VRT activity | 2026-11-13 | Most recent commit touching this CVE's classification, patch or rule file. |