CVE

Id
36621  
CVE No.
CVE-2008-6504  
Status
Candidate  
Description
ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a u0023 representation for the # character.  
Phase
Assigned (20090323)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
399472 36621 CVE-2008-6504 CONFIRM:http://fisheye6.atlassian.com/cru/CR-9/  View
399473 36621 CVE-2008-6504 CONFIRM:http://issues.apache.org/struts/browse/WW-2692  View
399474 36621 CVE-2008-6504 CONFIRM:http://jira.opensymphony.com/browse/XW-641  View
399475 36621 CVE-2008-6504 CONFIRM:http://struts.apache.org/2.x/docs/s2-003.html  View
399476 36621 CVE-2008-6504 BID:32101  View
399477 36621 CVE-2008-6504 URL:http://www.securityfocus.com/bid/32101  View
399478 36621 CVE-2008-6504 OSVDB:49732  View
399479 36621 CVE-2008-6504 URL:http://osvdb.org/49732  View
399480 36621 CVE-2008-6504 SECUNIA:32495  View
399481 36621 CVE-2008-6504 URL:http://secunia.com/advisories/32495  View
399482 36621 CVE-2008-6504 SECUNIA:32497  View
399483 36621 CVE-2008-6504 URL:http://secunia.com/advisories/32497  View
399484 36621 CVE-2008-6504 VUPEN:ADV-2008-3003  View
399485 36621 CVE-2008-6504 URL:http://www.vupen.com/english/advisories/2008/3003  View
399486 36621 CVE-2008-6504 VUPEN:ADV-2008-3004  View
399487 36621 CVE-2008-6504 URL:http://www.vupen.com/english/advisories/2008/3004  View
399488 36621 CVE-2008-6504 XF:xwork-parameterinterceptor-security-bypass(46328)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
49923 JVNDB-2008-005233 Openfire の Admin コンソールの AuthCheck フィルタにおけるディレクトリトラバーサルの脆弱性 Openfire の Admin コンソールの AuthCheck フィルタには、ディレクトリトラバーサルの脆弱性が存在します。 CVE-2008-6508 36621 7.5 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-005233.html  View