CVE - CVE-2007-4556

CVE-ID
CVE-2007-4556	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:25524 URL:http://www.securityfocus.com/bid/25524 CONFIRM:http://forums.opensymphony.com/ann.jspa?annID=54 CONFIRM:http://issues.apache.org/struts/browse/WW-2030 CONFIRM:http://jira.opensymphony.com/browse/XW-544 CONFIRM:http://jira.opensymphony.com/secure/ReleaseNote.jspa?projectId=10050&styleName=Html&version=21701 CONFIRM:http://jira.opensymphony.com/secure/ReleaseNote.jspa?projectId=10050&styleName=Html&version=21706 CONFIRM:http://struts.apache.org/2.x/docs/s2-001.html CONFIRM:http://wiki.opensymphony.com/display/WW/1.2.3+Press+Release OSVDB:37072 URL:~~http://osvdb.org/37072~~ (Obsolete source) SECUNIA:26681 URL:http://secunia.com/advisories/26681 SECUNIA:26693 URL:http://secunia.com/advisories/26693 SECUNIA:26694 URL:http://secunia.com/advisories/26694 VUPEN:ADV-2007-3041 URL:~~http://www.vupen.com/english/advisories/2007/3041~~ (Obsolete source) VUPEN:ADV-2007-3042 URL:~~http://www.vupen.com/english/advisories/2007/3042~~ (Obsolete source)
Assigning CNA
MITRE Corporation
Date Record Created
20070827	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20070827)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)