{"cvss":0.0,"datePublished":"2022-05-11T00:00:00Z","dateUpdated":"2022-05-11T00:00:00Z","description":"The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.","dueDate":"","id":"CVE-2021-31805","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"Struts","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"Apache Struts Improper Neutralization of Special Elements used in an Expression Language Statement","vendor":"Apache"}