5

CVE-2008-6504: apache struts Improper Input Validation

CVSS: 5.0v2.0MediumModified
AliasesGHSA-wxw2-2mx5-c5qf
Published 23-03-2009Last modified 07-08-2024
Open JSON

Vulnerability summary

CVE-2008-6504 is a medium (CVSS 5.0) Improper Input Validation vulnerability in apache struts. EPSS estimates a 36.60% chance of exploitation in the next 30 days, higher than 98.4% of scored vulnerabilities. 4 public exploits are recorded.

Overall risk
37/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.0/10
010
Medium · v2.0 (NVD)
EPSS score
36.60%
0%100%
High · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits4reference, exploit-database

Timeline

  1. 23-03-2009
    PublishedVulnerability first disclosed.
  2. 07-08-2024
    Last modifiedVulnerability information updated.

Description

ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

36.60%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

0.00 pp

From 36.60% on 18-09-2026

18-09-202618-10-2026
EPSS score
36.60%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

4 found
  • referenceUnverified

    Exploit Reference (struts.apache.org)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (jira.opensymphony.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (issues.apache.org)

    Maturity: unknown

Show all 4 exploits
  • exploit-databaseremotemultipleVerified

    XWork < 2.0.11.2 - 'ParameterInterceptor' Class OGNL Security Bypass

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Apache1 product
  • strutsEOL2.0.0 | 2.0.2 | 2.0.3 | 2.0.4 | 2.0.5 | 2.0.6 | 2.0.7 | 2.0.8 | 2.0.9 | 2.0.11 | 2.0.11.1 | 2.0.11.2
Com.opensymphony1 product
  • xwork< 2.0.6 | ≥ 2.1.0, < 2.1.2
Opensymphony1 product
  • xwork2.0.0 | 2.0.1 | 2.0.2 | 2.0.3 | 2.0.4 | 2.0.5 | 2.1.0 | 2.1.1

3 vendors · 3 products

References

15 links
Show all 15 references