CVE-2010-1870: apache struts

Vulnerability summary

CVE-2010-1870 is a medium (CVSS 5.0) vulnerability in apache struts. EPSS estimates a 92.02% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 17-08-2010
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the "#" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.

No weakness data has been published for this record.