Meder Kydyraliev has reported a vulnerability in Apache Struts, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to an error in XWork, which can be exploited to modify server-side objects and e.g. execute arbitrary commands via specially crafted OGNL (Object-Graph Navigation Language) expressions.

For more information:
SA40558

Solution
Update to version 2.2.1.
Further details available to Secunia VIM customers

Provided and/or discovered by
Meder Kydyraliev, Google Security Team

Changelog
Further details available to Secunia VIM customers

Original Advisory
Apache:
http://struts.apache.org/2.x/docs/s2-005.html

Meder Kydyraliev:
http://blog.o0o.nu/2010/07/cve-2010-1870-struts2xwork-remote.html

Other references
Further details available to Secunia VIM customers

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers