CVE-2019-0230

Exploitation

Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.

SSVC decision

Not assessed by CISA

EPSS probability

97.11% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 99.9% of scored records. A rank, not a probability.

NVD base score

9.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2020-09-14 16:41Z5 YR AGO

Last updated

2024-08-04 17:44Z2 YR AGO

Reserved

2018-11-14

Assigning CNA

apache

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

• CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')Variant
• CWE-20Improper Input ValidationClass

Data version

5.1

Document digest

451e00e097993aca930c08fcd5bd5af0b3ddff30c7506c1fdfd457bb0e49b19b

• cwiki.apache.orghttps://cwiki.apache.org/confluence/display/ww/s2-059x_refsource_MISC
• www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2021.htmlx_refsource_MISC
• packetstormsecurity.comhttp://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.htmlx_refsource_MISC
• launchpad.support.sap.comhttps://launchpad.support.sap.com/#/notes/2982840x_refsource_MISC
• packetstormsecurity.comhttp://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.htmlx_refsource_MISC
• lists.apache.org[announce] 20210125 Apache Software Foundation Security Report: 2020https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[announce] 20210223 Re: Apache Software Foundation Security Report: 2020https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3Emailing-listx_refsource_MLIST
• www.oracle.comhttps://www.oracle.com/security-alerts/cpuApr2021.htmlx_refsource_MISC
• www.oracle.comhttps://www.oracle.com/security-alerts/cpuoct2021.htmlx_refsource_MISC