CVE-2021-31805 (Critical) detected in struts2-core-2.5.26.jar

[mend-for-github-com]

CVE-2021-31805 - Critical Severity Vulnerability

Vulnerable Library - struts2-core-2.5.26.jar

Library home page: http://struts.apache.org/

Path to dependency file: /app/pom.xml

Path to vulnerable library: /canner/.m2/repository/org/apache/struts/struts2-core/2.5.26/struts2-core-2.5.26.jar

Dependency Hierarchy:

• ❌ struts2-core-2.5.26.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.

Publish Date: 2022-04-12

URL: CVE-2021-31805

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cwiki.apache.org/confluence/display/WW/S2-062

Release Date: 2022-04-12

Fix Resolution: 2.5.30

---

• Check this box to open an automated fix PR