CVE ID(s)

There's no CVE for this.

Report

I created a query to detect OGNL injections in Java code. The query raises a flag if user-provided OGNL expression is evaluated. OGNL library and Struts2 (OgnlUtil class) are supported.

The details are present in PR: github/codeql#3294

• Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). We would love to have you spread the word about the good work you are doing