Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the "#" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Apache Atlassian Fisheye Struts Xwork设计错误漏洞
Vulnerability Description
XWork是一个命令模式框架，用于支持Struts 2及其他应用。 在Atlassian Fisheye，Crucible和其他产品中使用的Struts 2.0.0至2.1.8.1版本中的Xwork中的OGNL表达式赋值功能使用许可的白名单，远程攻击者可以借助(1)#context，(2)#_memberAccess，(3)#root，(4)#this，(5)#_typeResolver，(6)#_classResolver，(7)#_traceEvaluations，(8)#_lastEvaluatio
CVSS Information
N/A
Vulnerability Type
N/A