CVSS: 5.3EPSS: 65%CPEs: 20EXPL: 4CVE-2008-6504 – XWork < 2.0.11.2 - 'ParameterInterceptor' Class OGNL Security Bypass
https://notcve.org/view.php?id=CVE-2008-6504
23 Mar 2009 — ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character. ParametersInterceptor en OpenSymphony XWork 2.0.x antes de 2.0.6 y 2.1.x antes de 2.1.2, tal como se uti... • https://www.exploit-db.com/exploits/32564 • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 3%CPEs: 2EXPL: 0CVE-2007-4556
https://notcve.org/view.php?id=CVE-2007-4556
28 Aug 2007 — Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character. Struts apoyado en OpenSymphony XWork anterior a 1.2.3, y 2.x anterior a 2.0.4, tal y como se utiliza en W... • http://forums.opensymphony.com/ann.jspa?annID=54 •