CVE-2007-4556 - Secunia Advisories - Vulnerability Information

CVE Reference: CVE-2007-4556
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2007-4556

Description: Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character.

CVE Status: Candidate

References: SAID Secunia Advisory: SA26681 Secunia Advisory: SA26693 Secunia Advisory: SA26694 OSVDB 37072 CONFIRM http://jira.opensymphony.com/secure/ReleaseNote.jspa?projectId=10050&styleName=Html&version=21706 http://wiki.opensymphony.com/display/WW/1.2.3+Press+Release http://struts.apache.org/2.x/docs/s2-001.html http://jira.opensymphony.com/secure/ReleaseNote.jspa?projectId=10050&styleName=Html&version=21701 http://issues.apache.org/struts/browse/WW-2030 http://jira.opensymphony.com/browse/XW-544 http://forums.opensymphony.com/ann.jspa?annID=54 BID 25524

Return to the previous page.