CVE-2010-1870: Medium severity apache struts 2 vulnerability
OGNL provides, among other features, extensive expression evaluation capabilities. This vulnerability allows a malicious user to bypass the '#'-usage protection built into the ParametersInterceptor, thus being able to manipulate server side context objects. This behavior was already addressed in S2-003, but it turned out that the resulting fix based on whitelisting acceptable parameter names closed the vulnerability only partially.
Other sources
The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the "#" protection mechanism in ParameterInterceptors via the (1) #context, (2) #memberAccess, (3) #root, (4) #this, (5) #typeResolver, (6) #classResolver, (7) #traceEvaluations, (8) #lastEvaluation, (9) #keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1870?
CVE-2010-1870 is considered a high severity vulnerability due to its potential for server-side context object manipulation.
How do I fix CVE-2010-1870?
To resolve CVE-2010-1870, upgrade to Apache Struts version 2.2.1 or later.
What are the affected versions related to CVE-2010-1870?
The affected versions of Apache Struts include 2.0.0, 2.0.1, 2.0.2, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.11.1, 2.0.11.2, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.8, and 2.1.8.1.
Who is affected by CVE-2010-1870?
Any application that uses the affected versions of Apache Struts may be vulnerable to CVE-2010-1870.
What is the main impact of CVE-2010-1870?
The main impact of CVE-2010-1870 is the ability for an attacker to manipulate server-side objects, potentially leading to further exploitation or unauthorized access.