CVE-2010-1870— Apache Atlassian Fisheye Struts Xwork设计错误漏洞

N/A

The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the "#" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.

N/A

N/A

Apache Atlassian Fisheye Struts Xwork设计错误漏洞

XWork是一个命令模式框架，用于支持Struts 2及其他应用。 在Atlassian Fisheye，Crucible和其他产品中使用的Struts 2.0.0至2.1.8.1版本中的Xwork中的OGNL表达式赋值功能使用许可的白名单，远程攻击者可以借助(1)#context，(2)#_memberAccess，(3)#root，(4)#this，(5)#_typeResolver，(6)#_classResolver，(7)#_traceEvaluations，(8)#_lastEvaluatio

N/A

N/A