CVE-2007-4556

Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character.

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

25.75% chance of exploitation in the next 30 days, 98th percentile

Nuclei

medium

Published

2007-08-28

Updated

2024-08-07

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2007/CVE-2007-4556.yaml

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2007/CVE-2007-4556.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2007-4553
• CVE-2007-4559
• CVE-2007-4552
• CVE-2007-4560
• CVE-2007-4551
• CVE-2007-4566