CVE-2007-4556 OpenSymphony XWork vulnerable to improper input validation
MediumCVSS 6.8
EPSS 25.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opensymphony/xwork(Maven) | < 1.2.3 | 1.2.3 |
| opensymphony/xwork(Maven) | >= 2.0.0, <= 2.0.3 | No fix listed |
| opensymphony/xwork | < 1.2.3 | 1.2.3 |
| opensymphony/xwork | >= 2.0.0, <= 2.0.4 | No fix listed |
| opensymphony/xwork(Maven) | = 1.0 | No fix listed |
| opensymphony/xwork(Maven) | = 1.0.1 | No fix listed |
| opensymphony/xwork(Maven) | = 1.0.3 | No fix listed |
| opensymphony/xwork(Maven) | = 1.0.4 | No fix listed |
| opensymphony/xwork(Maven) | = 1.0.5 | No fix listed |
| opensymphony/xwork(Maven) | = 1.1 | No fix listed |
| opensymphony/xwork(Maven) | = 1.1.1 | No fix listed |
| opensymphony/xwork(Maven) | = 1.1.3 | No fix listed |
| opensymphony/xwork(Maven) | = 1.2 | No fix listed |
| opensymphony/xwork(Maven) | = 1.2.1 | No fix listed |
| opensymphony/xwork(Maven) | = 1.2.2 | No fix listed |
| opensymphony/xwork(Maven) | >= 2.0.0, < 2.0.4 | 2.0.4 |
| opensymphony/xwork(Maven) | = 2.0.0 | No fix listed |
| opensymphony/xwork(Maven) | = 2.0.0-j4 | No fix listed |
| opensymphony/xwork(Maven) | = 2.0.1 | No fix listed |
| opensymphony/xwork(Maven) | = 2.0.1-j4 | No fix listed |
| opensymphony/xwork(Maven) | = 2.0.2 | No fix listed |
| opensymphony/xwork(Maven) | = 2.0.3 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- struts.apache.org patch third-party-advisory
- github.com
- forums.opensymphony.com patch vendor-advisory
- issues.apache.org third-party-advisory
- jira.opensymphony.com vendor-advisory
- jira.opensymphony.com vendor-advisory
- jira.opensymphony.com vendor-advisory
- 37072 broken-link vdb-entry
- 26681 third-party-advisory
- 26693 third-party-advisory
- 26694 third-party-advisory
- wiki.opensymphony.com vendor-advisory
- 25524 third-party-advisory vdb-entry
- ADV-2007-3041 third-party-advisory vdb-entry
- ADV-2007-3042 third-party-advisory vdb-entry