internet-facing-service-vulnerabilitywidely-deployed-product-advisoryproof-of-concept-releasestandards-framework-update

Apache disclosed Struts RCE, Flink traversal flaws, and other 2020 vulnerabilities

Vulnerability Disclosure · 6 sources · Updated 3mo ago · First seen Aug 4, 2024

The Apache Software Foundation reported handling 376 new vulnerability reports across 101 top-level projects in 2020, closing 341 cases and assigning 151 CVEs while adopting new tooling and the CVE automation API to speed disclosure. The report highlighted several high-profile issues, including the Apache Struts flaw tracked as CVE-2019-0230, where forced double OGNL evaluation in tag attributes can lead to remote code execution in Struts 2.0.0 through 2.5.20, alongside other notable Apache security events that drew public exploit or proof-of-concept attention.

Additional disclosures tied to that period included two Apache Flink directory traversal bugs, CVE-2020-17518 and CVE-2020-17519, affecting exposed REST APIs and enabling arbitrary file write or read access on vulnerable JobManager hosts; Apache said users should upgrade to Flink 1.11.3 or 1.12.0. Apache also published CVE-2020-13951, a denial-of-service issue in the public NetTest web service of Apache OpenMeetings 4.0.0 through 5.0.0, and CVE-2019-0235, a CSRF flaw in Apache OFBiz 17.12.01, underscoring the breadth of web, file-system, and application-layer risks disclosed across Apache projects.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

15 events · Apr 30, 2020 – Aug 4, 2024

Aug 4, 20242y ago
CVE-2020-17518 record updated
The CVE record for CVE-2020-17518 was updated. The entry continued to document the Apache Flink arbitrary file-write vulnerability and related references.
CVE Record: CVE-2020-17518
Jun 4, 20242y ago
CVE-2020-17519 record updated
The CVE record for CVE-2020-17519 was updated. The record retained details on the Apache Flink arbitrary file-read vulnerability and its remediation guidance.
CVE Record: CVE-2020-17519
Oct 20, 20215y ago
CVE-2019-0230 record updated
The CVE record for CVE-2019-0230 was updated. The updated record continued to reference downstream Oracle and SAP advisories and public exploit-related writeups.
CVE Record: CVE-2019-0230
Feb 24, 20216y ago
CVE-2019-0235 record updated
The CVE record for CVE-2019-0235 was updated. The record includes references to Apache security report announcements from January 25 and February 23, 2021.
CVE Record: CVE-2019-0235
Feb 24, 20216y ago
CVE-2020-13951 record updated
The CVE record for CVE-2020-13951 was updated. The entry references Apache security report messages published on January 25 and February 23, 2021.
CVE Record: CVE-2020-13951
Jan 5, 20216y ago
CVE-2020-17519 published for Apache Flink file-read traversal
A CVE record was published for CVE-2020-17519, describing a directory traversal vulnerability in Apache Flink 1.11.0 through 1.11.2 that allows arbitrary file reads via the JobManager REST API. Apache advised exposed users to upgrade to 1.11.3 or 1.12.0.
CVE Record: CVE-2020-17519
Jan 5, 20216y ago
Apache announced CVE-2020-17518 on mailing lists
Apache announced CVE-2020-17518 on Flink development, user, and announce mailing lists, and the issue was also referenced on the oss-security mailing list. Follow-up discussion and JIRA activity for FLINK-20875 continued during January 2021.
CVE Record: CVE-2020-17518
Jan 5, 20216y ago
CVE-2020-17518 published for Apache Flink file-write traversal
A CVE record was published for CVE-2020-17518, describing a directory traversal vulnerability in Apache Flink 1.5.1 through 1.11.2 that can enable remote file writing through the REST API. Apache advised exposed users to upgrade to 1.11.3 or 1.12.0.
CVE Record: CVE-2020-17518
Jan 2021
ASF released its 2020 security report
The Apache Software Foundation released its 2020 security report in January 2021, summarizing 376 new vulnerability reports across 101 top-level projects in 2020 and 151 assigned CVEs from 341 closed reports. The report also highlighted public exploit activity affecting several Apache projects, including OpenMeetings, OFBiz, Struts, and Flink.
Re: Apache Software Foundation Security Report: 2020-Apache Mail Archives
Dec 2020
ASF obtained first live CVE via automation API
The Apache Software Foundation became the first organization to obtain a live CVE identifier using the new CVE automation API. ASF said the automation was intended to speed public CVE publication.
Re: Apache Software Foundation Security Report: 2020-Apache Mail Archives
Nov 2020
ASF released internal CVE submission tool
The Apache Software Foundation released an internal tool to help projects edit, validate, and submit CVE entries to MITRE. The change was highlighted as a process improvement in ASF's 2020 security reporting.
Re: Apache Software Foundation Security Report: 2020-Apache Mail Archives
Sep 30, 20206y ago
CVE-2020-13951 published for Apache OpenMeetings DoS flaw
A CVE record was published for CVE-2020-13951, describing a denial-of-service issue in the public NetTest web service of Apache OpenMeetings 4.0.0 through 5.0.0. The Apache Software Foundation was listed as the CNA.
CVE Record: CVE-2020-13951
Sep 14, 20206y ago
CVE-2019-0230 published for Apache Struts OGNL RCE flaw
A CVE record was published for CVE-2019-0230, covering a forced double OGNL evaluation issue in Apache Struts 2.0.0 through 2.5.20 that may lead to remote code execution. The record references Apache's S2-059 advisory.
CVE Record: CVE-2019-0230
Jul 2020
Apache OFBiz CVE-2019-0235 CSRF PoC discussed on mailing lists
Apache mailing list entries dated July 5 through July 8, 2020 discussed a proof of concept for the CSRF token issue tied to CVE-2019-0235, including an ofbiz-commits entry documenting the PoC under OFBIZ-11306.
CVE Record: CVE-2019-0235
Apr 30, 20207y ago
CVE-2019-0235 published for Apache OFBiz CSRF flaw
A CVE record was published for CVE-2019-0235, describing a cross-site request forgery vulnerability affecting Apache OFBiz 17.12.01. The Apache Software Foundation was listed as the CNA.
CVE Record: CVE-2019-0235

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

5 linked

Denial of Service in Apache OpenMeetings NetTest Web Service (CVE-2020-13951)Apache Struts Double OGNL Evaluation Remote Code Execution (CVE-2019-0230)CSRF in Apache OFBiz 17.12.01 (CVE-2019-0235)Apache Flink REST API Arbitrary File Write (CVE-2020-17518)Arbitrary file read in Apache Flink JobManager REST interface (CVE-2020-17519)

Affected products

1 linked

Apache Ofbiz

Organizations

1 linked

Apache Software Foundation

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

6 references tracked. Mallory keeps watching after this page renders.

Cve MitreAdvisories · Jan 1, 2026

CVE Record: CVE-2020-13951Open source ↗

Cve MitreAdvisories · Jan 1, 2026

CVE Record: CVE-2019-0235Open source ↗

Cve MitreAdvisories · Jan 1, 2026

CVE Record: CVE-2019-0230Open source ↗

Cve MitreAdvisories · Jan 1, 2026

CVE Record: CVE-2020-17519Open source ↗

Cve MitreAdvisories · Jan 1, 2026

CVE Record: CVE-2020-17518Open source ↗

Lists ApacheNews · Feb 24, 2021

Re: Apache Software Foundation Security Report: 2020-Apache Mail ArchivesOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

internet-facing-service-vulnerabilitywidely-deployed-product-advisoryproof-of-concept-releasestandards-framework-update

Apache disclosed Struts RCE, Flink traversal flaws, and other 2020 vulnerabilities

Vulnerability Disclosure · 6 sources · Updated 3mo ago · First seen Aug 4, 2024

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

15 events · Apr 30, 2020 – Aug 4, 2024

Aug 4, 20242y ago
CVE-2020-17518 record updated
The CVE record for CVE-2020-17518 was updated. The entry continued to document the Apache Flink arbitrary file-write vulnerability and related references.
CVE Record: CVE-2020-17518
Jun 4, 20242y ago
CVE-2020-17519 record updated
The CVE record for CVE-2020-17519 was updated. The record retained details on the Apache Flink arbitrary file-read vulnerability and its remediation guidance.
CVE Record: CVE-2020-17519
Oct 20, 20215y ago
CVE-2019-0230 record updated
The CVE record for CVE-2019-0230 was updated. The updated record continued to reference downstream Oracle and SAP advisories and public exploit-related writeups.
CVE Record: CVE-2019-0230
Feb 24, 20216y ago
CVE-2019-0235 record updated
The CVE record for CVE-2019-0235 was updated. The record includes references to Apache security report announcements from January 25 and February 23, 2021.
CVE Record: CVE-2019-0235
Feb 24, 20216y ago
CVE-2020-13951 record updated
The CVE record for CVE-2020-13951 was updated. The entry references Apache security report messages published on January 25 and February 23, 2021.
CVE Record: CVE-2020-13951
Jan 5, 20216y ago
CVE-2020-17519 published for Apache Flink file-read traversal
A CVE record was published for CVE-2020-17519, describing a directory traversal vulnerability in Apache Flink 1.11.0 through 1.11.2 that allows arbitrary file reads via the JobManager REST API. Apache advised exposed users to upgrade to 1.11.3 or 1.12.0.
CVE Record: CVE-2020-17519
Jan 5, 20216y ago
Apache announced CVE-2020-17518 on mailing lists
Apache announced CVE-2020-17518 on Flink development, user, and announce mailing lists, and the issue was also referenced on the oss-security mailing list. Follow-up discussion and JIRA activity for FLINK-20875 continued during January 2021.
CVE Record: CVE-2020-17518
Jan 5, 20216y ago
CVE-2020-17518 published for Apache Flink file-write traversal
A CVE record was published for CVE-2020-17518, describing a directory traversal vulnerability in Apache Flink 1.5.1 through 1.11.2 that can enable remote file writing through the REST API. Apache advised exposed users to upgrade to 1.11.3 or 1.12.0.
CVE Record: CVE-2020-17518
Jan 2021
ASF released its 2020 security report
The Apache Software Foundation released its 2020 security report in January 2021, summarizing 376 new vulnerability reports across 101 top-level projects in 2020 and 151 assigned CVEs from 341 closed reports. The report also highlighted public exploit activity affecting several Apache projects, including OpenMeetings, OFBiz, Struts, and Flink.
Re: Apache Software Foundation Security Report: 2020-Apache Mail Archives
Dec 2020
ASF obtained first live CVE via automation API
The Apache Software Foundation became the first organization to obtain a live CVE identifier using the new CVE automation API. ASF said the automation was intended to speed public CVE publication.
Re: Apache Software Foundation Security Report: 2020-Apache Mail Archives
Nov 2020
ASF released internal CVE submission tool
The Apache Software Foundation released an internal tool to help projects edit, validate, and submit CVE entries to MITRE. The change was highlighted as a process improvement in ASF's 2020 security reporting.
Re: Apache Software Foundation Security Report: 2020-Apache Mail Archives
Sep 30, 20206y ago
CVE-2020-13951 published for Apache OpenMeetings DoS flaw
A CVE record was published for CVE-2020-13951, describing a denial-of-service issue in the public NetTest web service of Apache OpenMeetings 4.0.0 through 5.0.0. The Apache Software Foundation was listed as the CNA.
CVE Record: CVE-2020-13951
Sep 14, 20206y ago
CVE-2019-0230 published for Apache Struts OGNL RCE flaw
A CVE record was published for CVE-2019-0230, covering a forced double OGNL evaluation issue in Apache Struts 2.0.0 through 2.5.20 that may lead to remote code execution. The record references Apache's S2-059 advisory.
CVE Record: CVE-2019-0230
Jul 2020
Apache OFBiz CVE-2019-0235 CSRF PoC discussed on mailing lists
Apache mailing list entries dated July 5 through July 8, 2020 discussed a proof of concept for the CSRF token issue tied to CVE-2019-0235, including an ofbiz-commits entry documenting the PoC under OFBIZ-11306.
CVE Record: CVE-2019-0235
Apr 30, 20207y ago
CVE-2019-0235 published for Apache OFBiz CSRF flaw
A CVE record was published for CVE-2019-0235, describing a cross-site request forgery vulnerability affecting Apache OFBiz 17.12.01. The Apache Software Foundation was listed as the CNA.
CVE Record: CVE-2019-0235

Linked entities