Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2008-6504 — Improper Input Validation in Apache Struts

CWE-20 — Improper Input Validation9 documents7 sources
Severity
5.0MEDIUMNVD
EPSS
65.1%
top 1.52%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Apache StrutsOpensymphony Xwork
Timeline
PublishedMar 23
Latest updateMay 17

Description

ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.

CVSS vector

AV:N/AC:L/C:N/I:P/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶NVDapache/struts12 versions+11
▶NVDopensymphony/xwork8 versions+7

Patches

Patch: fisheye6.atlassian.com ↗Patch: fisheye6.atlassian.com ↗

🔴Vulnerability Details

3
OSV
Improper Input Validation in OpenSymphony XWork↗2022-05-17
▶
GHSA
Improper Input Validation in OpenSymphony XWork↗2022-05-17
▶
CVEList
CVE-2008-6504: ParametersInterceptor in OpenSymphony XWork 2↗2009-03-23
▶

💥Exploits & PoCs

1
Exploit-DB
XWork < 2.0.11.2 - 'ParameterInterceptor' Class OGNL Security Bypass↗2008-11-04
▶

📋Vendor Advisories

2
Red Hat
Struts2/WebWorks/XWork: ParameterInterceptors bypass allows remote command execution↗2010-07-25
▶
Red Hat
Struts2/WebWorks/XWork: ParameterInterceptors bypass allows OGNL statement execution↗2008-06-12
▶

💬Community

1
Bugzilla
CVE-2008-6504 Apache Struts2/WebWorks/XWork: ParameterInterceptors bypass allows OGNL statement execution↗2014-07-28
▶
CVE-2008-6504 — Improper Input Validation in Apache | cvebase