CVE-2007-4556

https://notcve.org/view.php?id=CVE-2007-4556

28 Aug 2007 — Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character. Struts apoyado en OpenSymphony XWork anterior a 1.2.3, y 2.x anterior a 2.0.4, tal y como se utiliza en W... • http://forums.opensymphony.com/ann.jspa?annID=54 •