CVE-2008-6504: Input Validation
ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenSymphony XWorkto a version that resolves this vulnerability.Fixed in 2.0.6 - Upgrade
Upgrade
OpenSymphony XWorkto a version that resolves this vulnerability.Fixed in 2.1.2
Event History
Frequently Asked Questions
What is the severity of CVE-2008-6504?
CVE-2008-6504 has a severity rating that indicates it can lead to remote code execution vulnerabilities.
How do I fix CVE-2008-6504?
To fix CVE-2008-6504, upgrade to OpenSymphony XWork version 2.0.6 or later, or 2.1.2 or later, or Apache Struts versions 2.0.11.2 or later.
What systems are affected by CVE-2008-6504?
CVE-2008-6504 affects OpenSymphony XWork versions 2.0.0 through 2.0.5 and 2.1.0 through 2.1.1 as well as Apache Struts versions 2.0.0 through 2.0.11.1.
What type of vulnerability is CVE-2008-6504?
CVE-2008-6504 is a remote code execution vulnerability stemming from improper handling of OGNL statements.
Can CVE-2008-6504 be exploited remotely?
Yes, CVE-2008-6504 can be exploited remotely by attackers to execute arbitrary code.