CVE-2010-1870
mediumpriority · attend · 62EPSS 0.920 · 100 %ileexploit · functionalEURUUSEPSS · scored 2026-10-26
The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the "#" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (3)
Public proof-of-concept and weaponised exploit code.
- EDB-17691Apache Struts < 2.2.0 - Remote Command Execution (Metasploit)functional · exploit_db
- exploit/multi/http/struts_code_execApache Struts Remote Command Executionfunctional · metasploit
- EDB-14360Struts2/XWork < 2.2.0 - Remote Command ExecutionPoC · exploit_db
affected products (45)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-x5fc-pgpx-59j5Server side object manipulation in Apache Struts2022-05-13ghsa · osvUS
OGNL provides, among other features, extensive expression evaluation capabilities. This vulnerability allows a malicious user to bypass the '#'-usage protection built into the ParametersInterceptor, thus being able to manipulate server side context objects. This behavior was already addressed in [S2-003](https://cwiki.apache.org/confluence/display/WW/S2-003), but it turned out that the resulting fix based on whitelisting acceptable parameter names closed the vulnerability only partially.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (24)
External citations — patches, advisories, analysis.
- http://blog.o0o.nu/2010/07/cve-2010-1870-struts2xwork-remote.htmlenisa_euvd
- http://confluence.atlassian.com/display/FISHEYE/FishEye+Security+Advisory+2010-06-16enisa_euvd
- http://packetstormsecurity.com/files/159643/LISTSERV-Maestro-9.0-8-Remote-Code-Execution.htmlenisa_euvd
- http://seclists.org/fulldisclosure/2010/Jul/183enisa_euvd
- http://seclists.org/fulldisclosure/2020/Oct/23enisa_euvd
- http://secunia.com/advisories/59110enisa_euvd
- http://securityreason.com/securityalert/8345enisa_euvd
- http://struts.apache.org/2.2.1/docs/s2-005.htmlenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan