CVE-2007-4556
Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 25.7%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 25.75% probability · 98th percentile
- CISA KEV
- Not listed
- Affected
- opensymphony/xwork
- Source
- cve@mitre.org
References
- http://forums.opensymphony.com/ann.jspa?annID=54Patch, Vendor Advisory
- http://issues.apache.org/struts/browse/WW-2030Third Party Advisory
- http://jira.opensymphony.com/browse/XW-544Vendor Advisory
- http://jira.opensymphony.com/secure/ReleaseNote.jspa?projectId=10050&styleName=Html&version=21701Vendor Advisory
- http://jira.opensymphony.com/secure/ReleaseNote.jspa?projectId=10050&styleName=Html&version=21706Vendor Advisory
- http://osvdb.org/37072Broken Link
- http://secunia.com/advisories/26681Third Party Advisory
- http://secunia.com/advisories/26693Third Party Advisory
- http://secunia.com/advisories/26694Third Party Advisory
- http://struts.apache.org/2.x/docs/s2-001.htmlPatch, Third Party Advisory
- http://wiki.opensymphony.com/display/WW/1.2.3+Press+ReleaseVendor Advisory
- http://www.securityfocus.com/bid/25524Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2007/3041Third Party Advisory
- http://www.vupen.com/english/advisories/2007/3042Third Party Advisory
- http://forums.opensymphony.com/ann.jspa?annID=54Patch, Vendor Advisory
- http://issues.apache.org/struts/browse/WW-2030Third Party Advisory
- http://jira.opensymphony.com/browse/XW-544Vendor Advisory
- http://jira.opensymphony.com/secure/ReleaseNote.jspa?projectId=10050&styleName=Html&version=21701Vendor Advisory
- http://jira.opensymphony.com/secure/ReleaseNote.jspa?projectId=10050&styleName=Html&version=21706Vendor Advisory
- http://osvdb.org/37072Broken Link
- http://secunia.com/advisories/26681Third Party Advisory
- http://secunia.com/advisories/26693Third Party Advisory
- http://secunia.com/advisories/26694Third Party Advisory
- http://struts.apache.org/2.x/docs/s2-001.htmlPatch, Third Party Advisory
- http://wiki.opensymphony.com/display/WW/1.2.3+Press+ReleaseVendor Advisory
- http://www.securityfocus.com/bid/25524Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2007/3041Third Party Advisory
- http://www.vupen.com/english/advisories/2007/3042Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.