Unscored severity · published Aug 28, 2007
CVE-2007-4556
Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation…
–
CVSS
25.7%
EPSS
No
On KEV
Description
Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character.
Exploitation
Is it being used?
Exploit prediction (EPSS)25.7% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XW
Xwork · Opensymphony
before 1.2.3; 2.0.0 through 2.0.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-4556
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-4556
Patch
http://forums.opensymphony.com/ann.jspa?annID=54
Third Party Advisory
http://issues.apache.org/struts/browse/WW-2030
Vendor Advisory
http://jira.opensymphony.com/browse/XW-544
Vendor Advisory
http://jira.opensymphony.com/secure/ReleaseNote.jspa?projectId=10050&styleName=Html&version=21701
Vendor Advisory
http://jira.opensymphony.com/secure/ReleaseNote.jspa?projectId=10050&styleName=Html&version=21706
Broken Link
http://osvdb.org/37072
More from Xwork
–
CVE-2011-2088
XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class…
–
CVE-2011-1772
Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject…
–
CVE-2008-6504
ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign)…