CVE-2025-53192
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-08-18

Last updated on: 2025-11-04

Assigner: Apache Software Foundation

Description
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL. This issue affects Apache Commons OGNL: all versions. When using the API Ognl.getValue​, the OGNL engine parses and evaluates the provided expression with powerful capabilities, including accessing and invoking related methods, etc. Although OgnlRuntime attempts to restrict certain dangerous classes and methods (such as java.lang.Runtime) through a blocklist, these restrictions are not comprehensive. Attackers may be able to bypass the restrictions by leveraging class objects that are not covered by the blocklist and potentially achieve arbitrary code execution. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-08-18
Last Modified
2025-11-04
Generated
2026-05-07
AI Q&A
2025-08-18
EPSS Evaluated
2026-05-05
NVD
CVE-2025-53192
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
apache commons_ognl *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-146 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is an Improper Neutralization of Expression/Command Delimiters in Apache Commons OGNL. The OGNL engine evaluates expressions with powerful capabilities, including method invocation. Although there is a blocklist to restrict dangerous classes and methods, it is not comprehensive. Attackers can bypass these restrictions using class objects not covered by the blocklist, potentially leading to arbitrary code execution.


How can this vulnerability impact me? :

If exploited, this vulnerability can allow attackers to execute arbitrary code on the affected system. This could lead to unauthorized actions, data compromise, or system control by attackers. Since the project is retired and no fix will be released, users must either restrict access to trusted users or migrate to alternatives.


What immediate steps should I take to mitigate this vulnerability?

Since Apache Commons OGNL is retired and no fixed version will be released, immediate mitigation steps include finding an alternative to Apache Commons OGNL or restricting access to the affected instance to trusted users only.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart