| Vulnerability Name: | CVE-2007-4556 (CCN-36428) | ||||||||
| Assigned: | 2007-07-21 | ||||||||
| Published: | 2007-07-21 | ||||||||
| Updated: | 2018-10-26 | ||||||||
| Summary: | Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character. | ||||||||
| CVSS v3 Severity: | 9.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
| ||||||||
| CVSS v2 Severity: | 6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P) 5.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
5.6 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-Other | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2007-4556 Source: CONFIRM Type: Patch, Vendor Advisory http://forums.opensymphony.com/ann.jspa?annID=54 Source: CCN Type: Apache Struts Web page - Key: WW-2030 User input is evaluated as an OGNL expression Source: CONFIRM Type: Third Party Advisory http://issues.apache.org/struts/browse/WW-2030 Source: CONFIRM Type: Vendor Advisory http://jira.opensymphony.com/browse/XW-544 Source: CONFIRM Type: Vendor Advisory http://jira.opensymphony.com/secure/ReleaseNote.jspa?projectId=10050&styleName=Html&version=21701 Source: CONFIRM Type: Vendor Advisory http://jira.opensymphony.com/secure/ReleaseNote.jspa?projectId=10050&styleName=Html&version=21706 Source: OSVDB Type: Broken Link 37072 Source: CCN Type: SA26681 XWork Input Validation OGNL Command Injection Vulnerability Source: SECUNIA Type: Third Party Advisory 26681 Source: CCN Type: SA26693 Apache Struts XWork Input Validation OGNL Command Injection Vulnerability Source: SECUNIA Type: Third Party Advisory 26693 Source: CCN Type: SA26694 Opensymphony WebWork XWork Input Validation OGNL Command Injection Source: SECUNIA Type: Third Party Advisory 26694 Source: CONFIRM Type: Patch, Third Party Advisory http://struts.apache.org/2.x/docs/s2-001.html Source: CCN Type: Opensymphony WebWork XWork Web page Xwork 1.2.3 Press Release - critical security issue allowing users to execute arbituary any OGNL expression Source: CONFIRM Type: Vendor Advisory http://wiki.opensymphony.com/display/WW/1.2.3+Press+Release Source: CCN Type: OSVDB ID: 37072 OpenSymphony XWork Struts OGNL Arbitrary Command Execution Source: BID Type: Third Party Advisory, VDB Entry 25524 Source: CCN Type: BID-25524 XWork AltSyntax OGNL Input Validation Vulnerability Source: VUPEN Type: Third Party Advisory ADV-2007-3041 Source: VUPEN Type: Third Party Advisory ADV-2007-3042 Source: XF Type: UNKNOWN opensymphony-ognl-code-execution(36428) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||