Lucene search

Veracode Vulnerability DatabaseVERACODE:7721

HistoryNov 09, 2018 - 5:25 a.m.

Unauthorized OGNL Execution

2018-11-0905:25:32

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

JSON

xwork is vulnerable to unauthorized OGNL execution attacks. The vulnerability exists due to the lack of sanitization of user input, allowing \u0023 to be used as interpreted as # to allow OGNL statements to be executed.

CPENameOperatorVersion
xworkle2.1.1
xworkle2.0.5
opensymphony:xworkle2.0.3

Name	Operator	Version
xwork	le	2.1.1
xwork	le	2.0.5
opensymphony:xwork	le	2.0.3

References

fisheye6.atlassian.com/cru/CR-9/

issues.apache.org/struts/browse/WW-2692

jira.opensymphony.com/browse/XW-641

osvdb.org/49732

secunia.com/advisories/32495

secunia.com/advisories/32497

struts.apache.org/2.x/docs/s2-003.html

www.securityfocus.com/bid/32101

www.vupen.com/english/advisories/2008/3003

www.vupen.com/english/advisories/2008/3004

cwiki.apache.org/confluence/display/WW/S2-003

exchange.xforce.ibmcloud.com/vulnerabilities/46328

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

JSON

Related for VERACODE:7721