The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Struts | — | Upgrade to Apache Struts version 2.0.9 | Jan 19, 2018 | Aug 27, 2007 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub