Critical Remote Code Execution in Apache Struts (CVE‑2020‑17530) Threatens Web Applications
What It Is – A forced Object‑Graph Navigation Language (OGNL) evaluation flaw in Apache Struts tag attributes permits an attacker to inject malicious OGNL code that the framework executes on the server.
Exploitability – Actively exploited in the wild; listed in CISA’s Known Exploited Vulnerabilities (KEV) program. CVSS v3.1 base score 9.8 (Critical).
Affected Products – Apache Struts (all versions prior to the security patch released in March 2020).
Why It Matters for Trust & Control Assurance
- Continuous monitoring of third‑party components is a core control for demonstrating due‑diligence in vulnerability‑management programs.
- Documented patch‑management evidence provides a defensible audit trail that enterprise buyers increasingly demand.
- Failure to remediate a known exploited flaw can break compliance mappings to control objectives across frameworks (e.g., NIST CSF Identify‑Risk Management).
Recommended Actions
- Inventory every application that includes Apache Struts and verify the exact version in use.
- Apply the vendor‑supplied security patch or upgrade to a non‑vulnerable release immediately.
- Update your vulnerability‑management toolset to flag Struts versions and capture remediation evidence for audit purposes.
Source: CISA KEV – CVE‑2020‑17530