vulnwire
6.8med

CVE-2007-4556Nuclei template

OpenSymphony XWork vulnerable to improper input validation

Also known as GHSA-h7mf-qrm9-2848

Published 19 y ago · modified 4 mo ago · JSON

CVSS
6.8
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
25.7%
percentile 98%
Public exploits
0
none known · Nuclei check

Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character.

Exploit prediction (EPSS)

25.75% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

Exploits and detections

  • Nuclei template OpenSymphony XWork/Apache Struts2 - Remote Code Execution · nuclei detection template

CVSS scores

Assigned byVersionScoreVector
NVD2.06.8AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected packages

EcosystemPackageAffectedFixed in
mavenopensymphony:xwork
<1.2.3
>=2.0.0, <2.0.4
1.2.3
2.0.4

Classification

Weakness
  • CWE-20 Improper Input Validation

References

  • securityfocus.com /bid/25524 · vdb-entry, x_refsource_BID, x_transferred
  • jira.opensymphony.com /browse/XW-544 · x_refsource_CONFIRM, x_transferred
  • issues.apache.org /struts/browse/WW-2030 · x_refsource_CONFIRM, x_transferred
  • vupen.com /english/advisories/2007/3041 · vdb-entry, x_refsource_VUPEN, x_transferred
  • forums.opensymphony.com /ann.jspa?annID=54 · x_refsource_CONFIRM, x_transferred
  • vupen.com /english/advisories/2007/3042 · vdb-entry, x_refsource_VUPEN, x_transferred
  • secunia.com /advisories/26693 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/26681 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • wiki.opensymphony.com /display/WW/1.2.3+Press+Release · x_refsource_CONFIRM, x_transferred
  • jira.opensymphony.com /secure/ReleaseNote.jspa?projectId=10050&styleName=Html&version=21706 · x_refsource_CONFIRM, x_transferred
  • osvdb.org /37072 · vdb-entry, x_refsource_OSVDB, x_transferred
  • struts.apache.org /2.x/docs/s2-001.html · x_refsource_CONFIRM, x_transferred
  • jira.opensymphony.com /secure/ReleaseNote.jspa?projectId=10050&styleName=Html&version=21701 · x_refsource_CONFIRM, x_transferred
  • secunia.com /advisories/26694 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2007-4556 · advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.