<em style='font-weight:bold;'>(Description Provided by <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2010-1870" target="_blank">CVE</a>)</em> : The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the &quot;#&quot; protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.

Currently, there are no known workarounds or upgrades to correct this issue. However, Apache has released a source code patch to address this vulnerability.

Unknown or Incomplete

• Exploit Database: 14360
• CVE ID: 2010-1870 (see also: NVD)
• Secunia Advisory ID: 40558 40575 40576 43717
• Bugtraq ID: 41592
• Metasploit ID: 66280
• Other Advisory URL: http://blog.o0o.nu/2010/07/cve-2010-1870-struts2xwork-remote.html
• Vendor Specific Advisory URL: http://confluence.atlassian.com/display/FISHEYE/FishEye+Security+Advisory+2010-06-16
  http://kb.vmware.com/kb/1034175
  http://svn.apache.org/viewvc?view=revision&revision=956389
  http://www.vmware.com/security/advisories/VMSA-2011-0005.html
• Mail List Post: http://seclists.org/fulldisclosure/2010/Jul/183
• Vendor Specific News/Changelog Entry: http://struts.apache.org/2.2.1/docs/s2-005.html
  https://issues.apache.org/jira/browse/WW-3470
• Generic Exploit URL: http://www.coresecurity.com/content/atlassian-fisheye-struts-2-parametersinterceptor-remote-code-execution-exploit-10-5
  http://www.saintcorporation.com/cgi-bin/exploit_info/struts_xwork_parameterinterceptor

Unknown or Incomplete