CVE-2021-31805

highpriority · attend · 79EPSS 0.854 · 100 %ileexploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

8 exploits · PoC

Likely / severe?

85.4% (100th) EPSS

CVSS 7.5 · high

Is it mine?

6 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-22

The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-917USprimaryCWE-917USCWE-917USCWE-94US

exploits (8)

Public proof-of-concept and weaponised exploit code.

JordanANDJohn/CVE-2021-31805-POCApache Struts2 S2-062(CVE-2021-31805)远程代码执行批量检测（无利用）PoC · poc_in_github
SecNN/Struts2_S2-062_CVE-2021-31805Apache Struts2 S2-062远程代码执行漏洞(CVE-2021-31805) | 反弹ShellPoC · poc_in_github
Wrin9/CVE-2021-31805S2-062 (CVE-2021-31805) / S2-061 / S2-059 RCEPoC · poc_in_github
aeyesec/CVE-2021-31805 PoC for CVE-2021-31805 (Apache Struts2)PoC · poc_in_github
jax7sec/S2-062Apache Struts2 S2-062远程代码执行漏洞(CVE-2021-31805) 支持批量扫描漏洞及漏洞利用PoC · poc_in_github
nth347/struts2-CVE-2021-31805Vulnerable environment of CVE-2021-31805 (S2-062) for testingPoC · poc_in_github

affected products (6)

Products and version ranges known to be affected.

Oracle Hyperion 11.2.23.0.000all versionscert_bundDEcpe:/a:oracle:hyperion:11.2.23.0.000
Oracle Hyperion 11.2.25.0.000all versionscert_bundDEcpe:/a:oracle:hyperion:11.2.25.0.000
Apache Software Foundation Apache Struts≤ 2.0.0 to 2.5.29enisa_euvdEU
Apache Software Foundation Struts≤ 2.5.30fstec_bduRU
apache struts2.0.0 → 2.5.29nvdUScpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*
Maven org.apache.struts:struts2-core2.0.0 → 2.5.30osvUSpkg:maven/org.apache.struts/struts2-core

advisories (5)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2022-0735Oracle MySQL: Mehrere SchwachstellenDeutsch2022-07-19csaf · cert_bundDE
Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2022-0815Apache Struts: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des DienstesDeutsch2022-04-12csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Struts ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen.
WID-SEC-W-2023-0130Oracle Hyperion: Mehrere SchwachstellenDeutsch2023-01-17csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Hyperion ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2026-2893Oracle Hyperion: Mehrere SchwachstellenDeutsch2026-08-18csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Hyperion ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
GHSA-v8j6-6c2r-r27cExpression Language Injection in Apache Struts2022-04-13ghsa · osvUS
The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund nvd osv NVD CVE.org MITRE

published 2022-04-12modified 2026-06-17

related (251)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-41901US	—OT critical	0.54% (45th)	Exploit	2026-05-12
Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mech…
CVE-2026-40478US	—OT critical	1.20% (68th)	—	2026-04-17
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression…
CVE-2026-40477US	—OT critical	0.94% (61st)	Exploit	2026-04-17
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression exec…
CVE-2022-26134US	critical9.8OT critical	100.0% (100th)	KEV	2022-06-03
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Conflu…
CVE-2022-22963US	critical9.8OT critical	99.9% (100th)	KEV	2022-04-01
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a r…

+246 more

references (17)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan