GitHub Advisoryadvisory · Maven

GHSA-wxw2-2mx5-c5qf Improper Input Validation in OpenSymphony XWork

MEDIUM Published 2022-05-17 Modified 2022-11-01 Official page ↗
Aliases
CVE-2008-6504
Ecosystem
Maven
Packages
com.opensymphony:xwork
Severity
Moderate
Weaknesses
CWE-20
Reviewed
2022-11-01

Affected packages

• Maven com.opensymphony:xwork: < 2.0.6 → fixed in 2.0.6 • Maven com.opensymphony:xwork: >= 2.1.0, < 2.1.2 → fixed in 2.1.2

Description

ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.

Related

Alias · CVE (1)

  • CVE-2008-6504 ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References