NVD

Id
56676  
Name
CVE-2007-4556  
Description
Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2007-08-27  
Modified Date
2011-03-07  
Seq
2007-4556  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
288807 56676 CVE-2007-4556 http://forums.opensymphony.com/ann.jspa?annID=54  View
288808 56676 CVE-2007-4556 http://issues.apache.org/struts/browse/WW-2030  View
288809 56676 CVE-2007-4556 http://jira.opensymphony.com/browse/XW-544  View
288810 56676 CVE-2007-4556 http://jira.opensymphony.com/secure/ReleaseNote.jspa?projectId=10050&styleName=Html&version=21701  View
288811 56676 CVE-2007-4556 http://jira.opensymphony.com/secure/ReleaseNote.jspa?projectId=10050&styleName=Html&version=21706  View
288812 56676 CVE-2007-4556 http://struts.apache.org/2.x/docs/s2-001.html  View
288813 56676 CVE-2007-4556 http://wiki.opensymphony.com/display/WW/1.2.3+Press+Release  View
288814 56676 CVE-2007-4556 25524  View
288815 56676 CVE-2007-4556 ADV-2007-3041  View
288816 56676 CVE-2007-4556 ADV-2007-3042  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
55644 JVNDB-2007-004336 OpenSymphony XWork の Struts サポートにおけるサービス運用妨害 (DoS) の脆弱性 WebWork および Apache Struts で使用される OpenSymphony XWork の Struts サポートは、altSyntax が有効になっている際、再帰的に全ての入力を Object-Graph Navigation Language (OGNL) 表記として評価するため、サービス運用妨害 (無限ループ) 状態となる、および任意のコードを実行される脆弱性が存在します。 CVE-2007-4556 27911 CVE-2007-4556 56676 6.8 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-004336.html 2007-08-27 2012-09-25 View