Patchfirst
Patchfirst
CVE-2010-1870 Public exploit EPSS 92.0%

The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian…

Summary

The OGNL expression evaluation in XWork as shipped with Struts 2.0.0 through 2.1.8.1 (and as used in Atlassian Fisheye and Crucible) relies on a permissive whitelist that fails to block access to OGNL context variables such as #context, #_memberAccess and #root. An attacker who can submit parameters to an affected application can use these variables to modify server-side context objects and bypass the "#" protection in ParameterInterceptors, with no details given on the required authentication, network position or user interaction.

Official description · CVE.org

The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the "#" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.

Breakdown
25.0 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Public exploit code (Metasploit) was available 35 days before disclosure.

  1. Public exploit codeMetasploit35 days before
  2. Disclosedday 0

6 fixes in struts2-core over 3 years. The latest fix listed for struts2-core is 2.2.3.1.

Fixes in struts2-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 2.1.1CVE-2008-66829 Apr 2009
  2. 2.1.3CVE-2008-650523 Mar 2009
  3. 2.2.1CVE-2010-187017 Aug 2010
  4. 2.2.3CVE-2011-177213 May 2011
  5. 2.2.3.1CVE-2012-03918 Jan 2012KEV
  6. 2.2.3.1CVE-2012-03928 Jan 2012Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.struts:struts2-core.

Mavenorg.apache.struts:struts2-coreGHSA-x5fc-pgpx-59j5

Upgrade to 2.5.33

Fixes this CVE and 23 other known vulnerabilities in this package (CVE-2008-6505, CVE-2011-3923, +21).

Still affected on this line by CVE-2024-53677 (fixed in 6.4.0, a newer line); CVE-2025-68493 (no fix published).

Set the version to 2.5.33 or later in your pom.xml or build.gradle.

First fixed in 2.2.1 for CVE-2010-1870.

Affected versions

If you runUpgrade to
All versions before 2.2.12.5.33first fix for this CVE: 2.2.1

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

12 links, grouped by NVD tag

x_refsource_CONFIRM 3

confluence.atlassian.com/display/FISHEYE/FishEye+Security+Advisory+2010-06-16struts.apache.org/2.2.1/docs/s2-005.htmltools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140709-struts2

exploit 1

exploit-db.com/exploits/14360

vdb-entry 2

securityfocus.com/bid/41592osvdb.org/66280

third-party-advisory 2

secunia.com/advisories/59110securityreason.com/securityalert/8345

x_refsource_MISC 2

blog.o0o.nu/2010/07/cve-2010-1870-struts2xwork-remote.htmlpacketstormsecurity.com/files/159643/LISTSERV-Maestro-9.0-8-Remote-Code-Execution.html

mailing-list 2

seclists.org/fulldisclosure/2010/Jul/183seclists.org/fulldisclosure/2020/Oct/23
↑ ↓ chooseEnter openEsc close