CVE-2010-1870

🗓️ 17 Aug 2010 17:31:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 183 Views🌐 WEB

Remote code execution vulnerability in XWork in Struts 2.0.0 through 2.1.8.1

Reporter	Title	Published	Views	Family All 47
IBM Security Bulletins	Security Bulletin: Order Management could be subject to an Apache Struts vulnerability that could allow a remote attacker to execute arbitrary code on the system.	12 Apr 202417:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Call Center and Apache Struts Struts upgrade strategy (various CVEs, see below)	14 Sep 202217:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Order Management Apache Struts upgrade strategy (various CVEs, see below)	14 Sep 202217:45	–	ibm
IBM Security Bulletins	Security Bulletin: Order Management could be subject to multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x.	12 Apr 202417:35	–	ibm
0day.today	Struts2/XWork < 2.2.0 Remote Command Execution Vulnerability	14 Jul 201000:00	–	zdt
0day.today	Apache Struts < 2.2.0 Remote Command Execution	19 Aug 201100:00	–	zdt
0day.today	LISTSERV Maestro 9.0-8 Remote Code Execution Vulnerability	21 Oct 202000:00	–	zdt
Circl	CVE-2010-1870	19 Aug 201100:00	–	circl
Cisco	Apache Struts 2 Command Execution Vulnerability in Multiple Cisco Products	9 Jul 201416:00	–	cisco
Check Point Advisories	Apache Struts2 ParametersInterceptor Remote Command Execution (CVE-2010-1870)	11 Aug 201000:00	–	checkpoint_advisories

NVD

Node

apache strutsMatch2.0.11.1

apache strutsMatch2.0.11.2

apache strutsMatch2.1.8.1

Source	Link
seclists	www.seclists.org/fulldisclosure/2010/Jul/183
confluence	www.confluence.atlassian.com/display/FISHEYE/FishEye+Security+Advisory+2010-06-16
exploit-db	www.exploit-db.com/exploits/14360
securityreason	www.securityreason.com/securityalert/8345
secunia	www.secunia.com/advisories/59110
seclists	www.seclists.org/fulldisclosure/2020/Oct/23
blog	www.blog.o0o.nu/2010/07/cve-2010-1870-struts2xwork-remote.html
osvdb	www.osvdb.org/66280
struts	www.struts.apache.org/2.2.1/docs/s2-005.html
packetstormsecurity	www.packetstormsecurity.com/files/159643/LISTSERV-Maestro-9.0-8-Remote-Code-Execution.html

Parameter	Position	Path	Description
_memberAccess['allowStaticMethodAccess']	query param	MyStruts.action	OGNL in Struts2 allows remote code execution via HTTP parameters (POC uses OGNL to bypass method access guards and execute arbitrary Java code).
context['xwork.MethodAccessor.denyMethodExecution']	query param	MyStruts.action	OGNL in Struts2 allows remote code execution via HTTP parameters (POC uses OGNL to bypass method access guards and execute arbitrary Java code).
rt	query param	MyStruts.action	OGNL in Struts2 allows remote code execution via HTTP parameters (POC uses OGNL to bypass method access guards and execute arbitrary Java code).

29 Apr 2026 01:13Current

9.1High risk

Vulners AI Score9.1

CVSS 25

EPSS0.92533