CVE-2021-31805 Public exploit EPSS 85.4%

Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.

Apache Software Foundation · Apache Struts

Official description · CVE.org

The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.

Breakdown

62.0 / 100

Exploited: Yes, in VulnCheck KEV
Reports: 0
Tactics: 0/15

First seen exploited 29 days after disclosure. Public exploit code (PoC-in-GitHub) appeared 3 days after disclosure.

Disclosed12 Apr 2022day 0
Public exploit codePoC-in-GitHub15 Apr 2022+3 days
First seen exploitedVulnCheck KEV evidence11 May 2022+29 days

See the family tree

A fix was bypassed or incomplete once over 16 months. The latest fix listed for struts2-core is 6.1.2.1.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2020-17530Struts Remote Code Execution11 Dec 2020KEV
incomplete fixHigh
Why these are linked:
- Stated in the CVE textThe fix issued for CVE-2020-17530 was incomplete.
- Fixed one release later2.5.26 → 2.5.30 (org.apache.struts:struts2-core)
- Similar weakness in the same product (machine-matched)same product + CWE + description similarity
This CVECVE-2021-31805Forced OGNL evaluation, when evaluated on raw not validated user…12 Apr 2022

Fixes in struts2-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

2.5.22CVE-2019-023014 Sep 2020
2.5.22CVE-2019-023314 Sep 2020
2.5.26CVE-2020-1753011 Dec 2020KEV
2.5.30CVE-2021-3180512 Apr 2022
6.1.1CVE-2025-6849311 Jan 2026
6.1.2.1CVE-2023-3414914 Jun 2023
6.1.2.1CVE-2023-3439614 Jun 2023Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.struts:struts2-core.

Mavenorg.apache.struts:struts2-coreGHSA-v8j6-6c2r-r27c

Upgrade to 2.5.33

Fixes this CVE and 23 other known vulnerabilities in this package (CVE-2008-6505, CVE-2010-1870, +21).

Still affected on this line by CVE-2024-53677 (fixed in 6.4.0, a newer line); CVE-2025-68493 (no fix published).

Set the version to 2.5.33 or later in your pom.xml or build.gradle.

First fixed in 2.5.30 for CVE-2021-31805.

Affected versions

If you run	Upgrade to
2.0.0 up to 2.5.30	2.5.33first fix for this CVE: 2.5.30

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 7 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Mirai, RAR1Ransom, and GuardMiner – Multiple Malware Campaigns Target VMware Vulnerability25 Oct 2022
Fortinet | multiple-malware-campaigns-target-vmware-vulnerability24 Oct 2022
Mirai, RAR1Ransom, and GuardMiner – Multiple Malware Campaigns Target VMware Vulnerability24 Oct 2022
2022 UNIT 42 NETWORK THREAT TRENDS RESEARCH REPORT30 Aug 2022
Public Cloud Cybersecurity Threat Intelligence (202204)11 May 2022
Critical RCE Bug in Struts 2 Framework for Java Applications Fully Fixed by Apache26 Apr 2022
1 more on OTX

References

4 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2022-1835

Public exploitAdvisories link exploit code.

, 30 Oct 2026

85.4%Top 0.28%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.72%).

No CVSS score published.

Priority factorsFormula

In a KEV cataloglisted in VulnCheck KEV 35.0/35

Recent KEV listingadded 1634 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9972 19.9/20

Threat reports0 reports 0.0/10

Public exploit code8 PoC-in-GitHub repos; 1 nuclei template 5.0/5

Mentioned in OTX pulses7 pulses 2.0/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total62.0

Record

Published: 12 Apr 2022
Modified: 3 Aug 2024
: CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in struts2-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions

What security researchers reported

Also mentioned in 7 community threat pulses (AlienVault OTX)

References

x_refsource_MISC 2

mailing-list 1

x_refsource_CONFIRM 1

techniques