CVE-2010-1870

🗓️ 17 Aug 2010 17:31:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 196 Views🌐 WEB

Remote code execution vulnerability in XWork in Struts 2.0.0 through 2.1.8.1

Reporter	Title	Published	Views	Family All 48
IBM Security Bulletins	Security Bulletin: Order Management could be subject to an Apache Struts vulnerability that could allow a remote attacker to execute arbitrary code on the system.	12 Apr 202417:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Call Center and Apache Struts Struts upgrade strategy (various CVEs, see below)	14 Sep 202217:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Order Management Apache Struts upgrade strategy (various CVEs, see below)	14 Sep 202217:45	–	ibm
IBM Security Bulletins	Security Bulletin: Order Management could be subject to multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x.	12 Apr 202417:35	–	ibm
0day.today	Struts2/XWork < 2.2.0 Remote Command Execution Vulnerability	14 Jul 201000:00	–	zdt
0day.today	Apache Struts < 2.2.0 Remote Command Execution	19 Aug 201100:00	–	zdt
0day.today	LISTSERV Maestro 9.0-8 Remote Code Execution Vulnerability	21 Oct 202000:00	–	zdt
BDU FSTEC	The vulnerability in the implementation of the OGNL expression transformation class for XWork command structures on the Apache Struts software platform allows attackers to circumvent security restrictions and execute arbitrary commands.	4 Oct 202200:00	–	bdu_fstec
Circl	CVE-2010-1870	19 Aug 201100:00	–	circl
Cisco	Apache Struts 2 Command Execution Vulnerability in Multiple Cisco Products	9 Jul 201416:00	–	cisco

NVD

Node

apache strutsMatch2.0.0

apache strutsMatch2.0.1

apache strutsMatch2.0.2

apache strutsMatch2.0.3

apache strutsMatch2.0.4

apache strutsMatch2.0.5

apache strutsMatch2.0.6

apache strutsMatch2.0.7

apache strutsMatch2.0.8

apache strutsMatch2.0.9

apache strutsMatch2.0.10

apache strutsMatch2.0.11

apache strutsMatch2.0.11.1

apache strutsMatch2.0.11.2

apache strutsMatch2.0.12

apache strutsMatch2.0.13

apache strutsMatch2.0.14

apache strutsMatch2.1.0

apache strutsMatch2.1.1

apache strutsMatch2.1.2

apache strutsMatch2.1.3

apache strutsMatch2.1.4

apache strutsMatch2.1.5

apache strutsMatch2.1.6

apache strutsMatch2.1.8

apache strutsMatch2.1.8.1

Source	Link
seclists	www.seclists.org/fulldisclosure/2010/Jul/183
confluence	www.confluence.atlassian.com/display/FISHEYE/FishEye+Security+Advisory+2010-06-16
exploit-db	www.exploit-db.com/exploits/14360
securityreason	www.securityreason.com/securityalert/8345
secunia	www.secunia.com/advisories/59110
seclists	www.seclists.org/fulldisclosure/2020/Oct/23
blog	www.blog.o0o.nu/2010/07/cve-2010-1870-struts2xwork-remote.html
osvdb	www.osvdb.org/66280
struts	www.struts.apache.org/2.2.1/docs/s2-005.html
packetstormsecurity	www.packetstormsecurity.com/files/159643/LISTSERV-Maestro-9.0-8-Remote-Code-Execution.html

Parameter	Position	Path	Description
_memberAccess['allowStaticMethodAccess']	query param	MyStruts.action	OGNL-based RCE via Struts2 vulnerable parameters executed through the redirect/action OGNL evaluation flow (CVE-2010-1870).
#context['xwork.MethodAccessor.denyMethodExecution']	query param	MyStruts.action	OGNL-based RCE via Struts2 vulnerable parameters executed through the redirect/action OGNL evaluation flow (CVE-2010-1870).
#rt	query param	MyStruts.action	OGNL-based RCE via Struts2 vulnerable parameters executed through the redirect/action OGNL evaluation flow (CVE-2010-1870).
#foo	query param	MyStruts.action	OGNL-based RCE via Struts2 vulnerable parameters executed through the redirect/action OGNL evaluation flow (CVE-2010-1870).
#root	query param	MyStruts.action	OGNL-based RCE via Struts2 vulnerable parameters executed through the redirect/action OGNL evaluation flow (CVE-2010-1870).
#this	query param	MyStruts.action	OGNL-based RCE via Struts2 vulnerable parameters executed through the redirect/action OGNL evaluation flow (CVE-2010-1870).
#_typeResolver	query param	MyStruts.action	OGNL-based RCE via Struts2 vulnerable parameters executed through the redirect/action OGNL evaluation flow (CVE-2010-1870).
#_classResolver	query param	MyStruts.action	OGNL-based RCE via Struts2 vulnerable parameters executed through the redirect/action OGNL evaluation flow (CVE-2010-1870).
#_traceEvaluations	query param	MyStruts.action	OGNL-based RCE via Struts2 vulnerable parameters executed through the redirect/action OGNL evaluation flow (CVE-2010-1870).
#_lastEvaluation	query param	MyStruts.action	OGNL-based RCE via Struts2 vulnerable parameters executed through the redirect/action OGNL evaluation flow (CVE-2010-1870).

16 Jun 2026 23:19Current

9.1High risk

Vulners AI Score9.1

CVSS 25

EPSS0.91079