Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
osvGoogleOSV:GHSA-X5FC-PGPX-59J5
HistoryMay 13, 2022 - 1:14 a.m.

Server side object manipulation in Apache Struts

2022-05-1301:14:26
Google
osv.dev
4

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.085 Low

EPSS

Percentile

94.4%

JSON

OGNL provides, among other features, extensive expression evaluation capabilities. This vulnerability allows a malicious user to bypass the ‘#’-usage protection built into the ParametersInterceptor, thus being able to manipulate server side context objects. This behavior was already addressed in S2-003, but it turned out that the resulting fix based on whitelisting acceptable parameter names closed the vulnerability only partially.

Related

saint 4
seebug 3
vmware 2
checkpoint_advisories 1
openvas 4
nessus 2
exploitpack 1
packetstorm 2
cisco 1
dsquare 2
zdt 1
d2 1
github 1
nuclei 1
exploitdb 1
canvas 1
prion 1
cve 1
ubuntucve 1
ibm 4
wallarmlab 1
kitploit 1
saint
saint
Apache Struts2 XWork ParameterInterceptor security bypass
2010-08-05 00:00:00
Apache Struts2 XWork ParameterInterceptor security bypass
2010-08-05 00:00:00
Apache Struts2 XWork ParameterInterceptor security bypass
2010-08-05 00:00:00
seebug
seebug
Struts2/XWork < 2.2.0 - Remote Command Execution Vulnerability
2014-07-01 00:00:00
Struts2/XWork &lt; 2.2.0 Remote Command Execution Vulnerability
2010-07-15 00:00:00
VMware vCenter Orchestrator和Alive Enterprise远程代码执行漏洞
2011-05-10 00:00:00
vmware
vmware
VMware vCenter Orchestrator and Alive Enterprise remote code execution vulnerability
2011-03-14 00:00:00
VMware vCenter Orchestrator and Alive Enterprise remote code execution vulnerability
2011-03-14 00:00:00
checkpoint_advisories
checkpoint_advisories
Apache Struts2 ParametersInterceptor Remote Command Execution (CVE-2010-1870)
2010-08-11 00:00:00
openvas
openvas
Struts Remote Command Execution Vulnerability
2010-09-10 00:00:00
Apache Struts2/XWork Remote Command Execution Vulnerability
2010-12-21 00:00:00
Apache Struts Security Update (S2-005) - Active Check
2010-12-21 00:00:00
nessus
nessus
Apache Struts 2.x < 2.2.1 OGNL RCE (S2-005)
2018-09-10 00:00:00
Apache Struts 2 / XWork Remote Code Execution (safe check)
2010-07-29 00:00:00
exploitpack
exploitpack
Struts2XWork 2.2.0 - Remote Command Execution
2010-07-14 00:00:00
packetstorm
packetstorm
Apache Struts < 2.2.0 Remote Command Execution
2011-08-19 00:00:00
Struts2/XWork Remote Command Execution
2010-07-14 00:00:00
cisco
cisco
Apache Struts 2 Command Execution Vulnerability in Multiple Cisco Products
2014-07-09 16:00:00
dsquare
dsquare
Apache-Struts < 2.2.0 RCE Linux
2012-01-26 00:00:00
Apache-Struts < 2.2.0 RCE Windows
2012-01-26 00:00:00
zdt
zdt
LISTSERV Maestro 9.0-8 Remote Code Execution Vulnerability
2020-10-21 00:00:00
d2
d2
DSquare Exploit Pack: D2SEC_STRUTS
2010-08-17 20:00:00
github
github
Server side object manipulation in Apache Struts
2022-05-13 01:14:26
nuclei
nuclei
ListSERV Maestro <= 9.0-8 RCE
2021-07-01 19:14:33
exploitdb
exploitdb
Struts2/XWork &lt; 2.2.0 - Remote Command Execution
2010-07-14 00:00:00
canvas
canvas
Immunity Canvas: STRUTSCODEINJECTION
2012-01-08 15:55:00
prion
prion
Design/Logic Flaw
2010-08-17 20:00:00
cve
cve
CVE-2010-1870
2010-08-17 20:00:00
ubuntucve
ubuntucve
CVE-2010-1870
2010-08-17 00:00:00
ibm
ibm
Security Bulletin: Order Management could be subject to multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x.
2024-04-12 17:35:43
Security Bulletin: Order Management could be subject to an Apache Struts vulnerability that could allow a remote attacker to execute arbitrary code on the system.
2024-04-12 17:44:56
Security Bulletin: IBM Sterling Order Management Apache Struts upgrade strategy (various CVEs, see below)
2022-09-14 17:45:15
wallarmlab
wallarmlab
New Struts2 Remote Code Execution exploit caught in the wild
2017-03-09 00:15:54
kitploit
kitploit
Vulmap - Web Vulnerability Scanning And Verification Tools
2020-12-25 11:30:00

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.085 Low

EPSS

Percentile

94.4%

JSON
Related for OSV:GHSA-X5FC-PGPX-59J5
saint4seebug3vmware2checkpoint_advisories1openvas4nessus2exploitpack1packetstorm2cisco1dsquare2zdt1d21github1nuclei1exploitdb1canvas1prion1cve1ubuntucve1ibm4wallarmlab1kitploit1