CVE Pulse
KO
CVE DatabaseCVE-2019-0230
한국어 권고문 →
CVE-2019-02309.8/CRITICALCWE-1321

CVE-2019-0230 Official NVD Security Advisory (CVSS 9.8)

⚡ Jump to Patch
Affected Vendors
security-advisory
Affected Components
software
Published Date
2020-09-14
CVSS v3.1
9.8
CRITICAL
EPSS (30d)
97.0%
FIRST.org
CISA KEV
Not Listed
NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT
Scope

Impacted configurations listed under CVE-2019-0230

Overview

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code exe...

Mitigation

Review official patches and verify network isolation controls.

Affected Products & Version Scope

Refer to official NVD CPE configuration entries

Remediation & Live Workaround Commands

PATCH & WORKAROUND

Apply the latest security updates provided by the official software maintainers.

Interactive SecOps Remediation Checklist
0/4 (0%)
Recommended Security Control & Mitigation Partner
Cloudflare Enterprise & Pro WAF
Audit runtime exposure and verify patching status via automated scanning.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules
Deploy Instant WAF Protection Free
Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab
Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

Official NVD Technical Description

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

  • CVSS Score: 9.8 (CRITICAL)
  • CWE IDs: CWE-1321

Official Vendor Advisories & References

NVD Original English Description

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

http://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.html
Source: security@apache.org · Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html
Source: security@apache.org · Exploit, Third Party Advisory, VDB Entry
https://cwiki.apache.org/confluence/display/ww/s2-059
Source: security@apache.org · Vendor Advisory
https://launchpad.support.sap.com/#/notes/2982840
Source: security@apache.org · Permissions Required
https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E
Source: security@apache.org
https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E
Source: security@apache.org

Frequently Asked SecOps Questions (CVE-2019-0230)

FAQ

Q1. How critical is CVE-2019-0230 and is it actively exploited in the wild?

CVE-2019-0230 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 97.0%. Organizations running affected versions should prioritize patching based on network exposure.

Q2. Which vendors and products are affected by CVE-2019-0230?

Primary impacted vendors include security-advisory across software. Scope summary: Refer to official NVD CPE configuration entries

Q3. What temporary mitigations or workarounds exist for CVE-2019-0230 before patching?

[Mitigation] Review official patches and verify network isolation controls. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION

Generate an Internal Engineering Notice or CISO Report for CVE-2019-0230

Instantly format this advisory into an executive CISO summary or engineering patch ticket.

Generate Report →

🔗 Related Advisories in Similar Stack (security-advisory)

View Category →
CVE-2026-1201147.2/HIGH
EPSS 0.4%

CVE-2026-120114 Technical Vulnerability Analysis & Patch Advisory (CVSS 7.2)

[Affected Scope] Systems running unpatched versions impacted by CVE-2026-120114

CVE-2026-10513410.0/CRITICALCISA KEV
EPSS 81.8%

Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)

[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component

CVE-2026-7565010.0/CRITICALCISA KEV
EPSS 34.7%

Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)

[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.

CVE-2026-7289810.0/CRITICALCISA KEV
EPSS 98.8%

Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)

[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed:
PatchKO