Vulnerability-Lookup

BDU:2022-06074 (CVE-2010-1870)

Vulnerability from fstec – Published: 2022-10-04 – Updated: 2026-04-30 – View on bdu.fstec.ru Exploit publicly available Fixed

Title

Уязвимость реализации класса преобразования выражений OGNL (Object-Graph Navigation Language) структуры шаблонов команд XWork программной платформы Apache Struts, позволяющая нарушителю обойти ограничения безопасности и выполнить произвольные команды

Summary

Уязвимость реализации класса преобразования выражений OGNL (Object-Graph Navigation Language) структуры шаблонов команд XWork программной платформы Apache Struts связана с недостатками разграничения доступа при использовании класса ParametersInterceptor с параметром #. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, обойти ограничения безопасности и выполнить произвольные команды с помощью специально созданных объектов #context, #_memberAccess, #root, #this, #_typeResolver, #_classResolver, #_traceEvaluations, #_lastEvaluation, #_keepLastEvaluation

Severity

5.0 (Medium) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:N/I:P/A:N

5.8 (Medium) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Class

Architecture vulnerability

Status

Confirmed by the vendor

Exploitation

Authorization bypass

Incidents

Being clarified

Remediation

Software update

CWE

CWE-264 - Разрешения, привилегии и средства управления доступом

Aliases

CVE-2010-1870

References

7 references

URL
https://confluence.atlassian.com/fisheye/fisheye-security-advisory-2010-06-16-9…
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-call-center-and-apache-st…
https://nvd.nist.gov/vuln/detail/CVE-2010-1870
https://cwiki.apache.org/confluence/display/WW/S2-005
https://seclists.org/fulldisclosure/2010/Jul/183
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2…
http://www.exploit-db.com/exploits/14360

Impacted products

7 products from 5 vendors

Vendors

IBM Corp., Apache Software Foundation, Atlassian, Cisco Systems, Inc.

Products

IBM Call Center for Commerce, Struts, Fisheye, Crucible, Cisco Identity Services Engine, Cisco Unified Contact Center Enterprise, Cisco Media Experience Engine (MXE) 3500 Series

Versions

9.5.0 (IBM Call Center for Commerce), 10.0 (IBM Call Center for Commerce), от 2.0.0 до 2.1.8.1 включительно (Struts), до 2.3.2 включительно (Fisheye), до 2.3.2 включительно (Crucible), до 1.0.4.573-6 (Cisco Identity Services Engine), от 1.1.0.665 до 1.1.0.665-4 (Cisco Identity Services Engine), от 1.1.1.268 до 1.1.1.268-6 (Cisco Identity Services Engine), от 1.1.2.145 до 1.1.2.145-9 (Cisco Identity Services Engine), от 1.1.3.124 до 1.1.3.124-4 (Cisco Identity Services Engine), от 1.1.4.218 до 1.1.4.218-4 (Cisco Identity Services Engine), от 1.2.0.0 до 1.2.0.899 (Cisco Identity Services Engine), от 10.5 до 10.5(1) (Cisco Unified Contact Center Enterprise), от 8.5(4) до 8.5(4)ES37 (Cisco Unified Contact Center Enterprise), от 9.0(4) до 9.0(4)ES39 (Cisco Unified Contact Center Enterprise), от 9.0(3) до 9.0(3)ES13 (Cisco Unified Contact Center Enterprise), до 3.3.2 (Cisco Media Experience Engine (MXE) 3500 Series)

Product types

Application software, Network appliance software, Network software, Network device

Mitigations

Использование рекомендаций: Для Apache Struts: https://cwiki.apache.org/confluence/display/WW/S2-005 Для программных продуктов Atlassian: https://confluence.atlassian.com/fisheye/fisheye-security-advisory-2010-06-16-960161732.html Для программных продуктов IBM: https://www.ibm.com/blogs/psirt/security-bulletin-ibm-call-center-and-apache-struts-struts-upgrade-strategy-various-cves-see-below/ Для программных продуктов Cisco: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140709-struts2 Компенсирующие меры: Следующая дополнительная конфигурация interceptor-ref поможет исключить вредоносные параметры: <interceptor-ref name="params"> <param name="excludeParams">dojo\..*,^struts\..*,.*\\.*,.*\(.*,.*\).*,.*@.*</param> </interceptor-ref>

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "IBM Corp., Apache Software Foundation, Atlassian, Cisco Systems, Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "9.5.0 (IBM Call Center for Commerce), 10.0 (IBM Call Center for Commerce), \u043e\u0442 2.0.0 \u0434\u043e 2.1.8.1 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Struts), \u0434\u043e 2.3.2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Fisheye), \u0434\u043e 2.3.2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Crucible), \u0434\u043e 1.0.4.573-6 (Cisco Identity Services Engine), \u043e\u0442 1.1.0.665 \u0434\u043e 1.1.0.665-4 (Cisco Identity Services Engine), \u043e\u0442 1.1.1.268 \u0434\u043e 1.1.1.268-6 (Cisco Identity Services Engine), \u043e\u0442 1.1.2.145 \u0434\u043e 1.1.2.145-9 (Cisco Identity Services Engine), \u043e\u0442 1.1.3.124 \u0434\u043e 1.1.3.124-4 (Cisco Identity Services Engine), \u043e\u0442 1.1.4.218 \u0434\u043e 1.1.4.218-4 (Cisco Identity Services Engine), \u043e\u0442 1.2.0.0 \u0434\u043e 1.2.0.899 (Cisco Identity Services Engine), \u043e\u0442 10.5 \u0434\u043e 10.5(1) (Cisco Unified Contact Center Enterprise), \u043e\u0442 8.5(4) \u0434\u043e 8.5(4)ES37 (Cisco Unified Contact Center Enterprise), \u043e\u0442 9.0(4) \u0434\u043e 9.0(4)ES39 (Cisco Unified Contact Center Enterprise), \u043e\u0442 9.0(3) \u0434\u043e 9.0(3)ES13 (Cisco Unified Contact Center Enterprise), \u0434\u043e 3.3.2 (Cisco Media Experience Engine (MXE) 3500 Series)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Apache Struts:\nhttps://cwiki.apache.org/confluence/display/WW/S2-005\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Atlassian:\nhttps://confluence.atlassian.com/fisheye/fisheye-security-advisory-2010-06-16-960161732.html\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 IBM:\nhttps://www.ibm.com/blogs/psirt/security-bulletin-ibm-call-center-and-apache-struts-struts-upgrade-strategy-various-cves-see-below/\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Cisco:\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140709-struts2\n\n\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n\u0421\u043b\u0435\u0434\u0443\u044e\u0449\u0430\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f interceptor-ref \u043f\u043e\u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b:\n\n\u003cinterceptor-ref name=\"params\"\u003e\n    \u003cparam name=\"excludeParams\"\u003edojo\\..*,^struts\\..*,.*\\\\.*,.*\\(.*,.*\\).*,.*@.*\u003c/param\u003e\n\u003c/interceptor-ref\u003e",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "31.05.2010",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "30.04.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "04.10.2022",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2022-06074",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2010-1870",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "IBM Call Center for Commerce, Struts, Fisheye, Crucible, Cisco Identity Services Engine, Cisco Unified Contact Center Enterprise, Cisco Media Experience Engine (MXE) 3500 Series",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0430\u0441\u0441\u0430 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 OGNL (Object-Graph Navigation Language) \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0448\u0430\u0431\u043b\u043e\u043d\u043e\u0432 \u043a\u043e\u043c\u0430\u043d\u0434 XWork \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Apache Struts, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0420\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f, \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c (CWE-264)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0430\u0441\u0441\u0430 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 OGNL (Object-Graph Navigation Language) \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0448\u0430\u0431\u043b\u043e\u043d\u043e\u0432 \u043a\u043e\u043c\u0430\u043d\u0434 XWork \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Apache Struts \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u0440\u0430\u0437\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u043a\u043b\u0430\u0441\u0441\u0430 ParametersInterceptor \u0441 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u043c #. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u0432 #context, #_memberAccess, #root, #this, #_typeResolver, #_classResolver, #_traceEvaluations, #_lastEvaluation, #_keepLastEvaluation",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://confluence.atlassian.com/fisheye/fisheye-security-advisory-2010-06-16-960161732.html\nhttps://www.ibm.com/blogs/psirt/security-bulletin-ibm-call-center-and-apache-struts-struts-upgrade-strategy-various-cves-see-below/\nhttps://nvd.nist.gov/vuln/detail/CVE-2010-1870\nhttps://cwiki.apache.org/confluence/display/WW/S2-005\nhttps://seclists.org/fulldisclosure/2010/Jul/183\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140709-struts2\nhttp://www.exploit-db.com/exploits/14360",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u041f\u041e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-264",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,8)"
}

CVE-2010-1870 (GCVE-0-2010-1870)

Vulnerability from cvelistv5 – Published: 2010-08-17 17:31 – Updated: 2024-08-07 01:35

Summary

The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the "#" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

12 references

URL	Tags
http://confluence.atlassian.com/display/FISHEYE/F…	x_refsource_CONFIRM
http://www.exploit-db.com/exploits/14360	exploitx_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/41592	vdb-entryx_refsource_BID
http://www.osvdb.org/66280	vdb-entryx_refsource_OSVDB
http://struts.apache.org/2.2.1/docs/s2-005.html	x_refsource_CONFIRM
http://secunia.com/advisories/59110	third-party-advisoryx_refsource_SECUNIA
http://blog.o0o.nu/2010/07/cve-2010-1870-struts2x…	x_refsource_MISC
http://tools.cisco.com/security/center/content/Ci…	x_refsource_CONFIRM
http://seclists.org/fulldisclosure/2010/Jul/183	mailing-listx_refsource_FULLDISC
http://securityreason.com/securityalert/8345	third-party-advisoryx_refsource_SREASON
http://seclists.org/fulldisclosure/2020/Oct/23	mailing-listx_refsource_FULLDISC
http://packetstormsecurity.com/files/159643/LISTS…	x_refsource_MISC

Date Public

2010-07-09 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T01:35:53.709Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://confluence.atlassian.com/display/FISHEYE/FishEye+Security+Advisory+2010-06-16"
          },
          {
            "name": "14360",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/14360"
          },
          {
            "name": "41592",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/41592"
          },
          {
            "name": "66280",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/66280"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://struts.apache.org/2.2.1/docs/s2-005.html"
          },
          {
            "name": "59110",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/59110"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://blog.o0o.nu/2010/07/cve-2010-1870-struts2xwork-remote.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140709-struts2"
          },
          {
            "name": "20100713 CVE-2010-1870: Struts2 remote commands execution",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2010/Jul/183"
          },
          {
            "name": "8345",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/8345"
          },
          {
            "name": "20201020 LISTSERV Maestro Remote Code Execution Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2020/Oct/23"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/159643/LISTSERV-Maestro-9.0-8-Remote-Code-Execution.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2010-07-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the \"#\" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-20T21:06:24.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://confluence.atlassian.com/display/FISHEYE/FishEye+Security+Advisory+2010-06-16"
        },
        {
          "name": "14360",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/14360"
        },
        {
          "name": "41592",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/41592"
        },
        {
          "name": "66280",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/66280"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://struts.apache.org/2.2.1/docs/s2-005.html"
        },
        {
          "name": "59110",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/59110"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://blog.o0o.nu/2010/07/cve-2010-1870-struts2xwork-remote.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140709-struts2"
        },
        {
          "name": "20100713 CVE-2010-1870: Struts2 remote commands execution",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2010/Jul/183"
        },
        {
          "name": "8345",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/8345"
        },
        {
          "name": "20201020 LISTSERV Maestro Remote Code Execution Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2020/Oct/23"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/159643/LISTSERV-Maestro-9.0-8-Remote-Code-Execution.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2010-1870",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the \"#\" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://confluence.atlassian.com/display/FISHEYE/FishEye+Security+Advisory+2010-06-16",
              "refsource": "CONFIRM",
              "url": "http://confluence.atlassian.com/display/FISHEYE/FishEye+Security+Advisory+2010-06-16"
            },
            {
              "name": "14360",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/14360"
            },
            {
              "name": "41592",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/41592"
            },
            {
              "name": "66280",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/66280"
            },
            {
              "name": "http://struts.apache.org/2.2.1/docs/s2-005.html",
              "refsource": "CONFIRM",
              "url": "http://struts.apache.org/2.2.1/docs/s2-005.html"
            },
            {
              "name": "59110",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/59110"
            },
            {
              "name": "http://blog.o0o.nu/2010/07/cve-2010-1870-struts2xwork-remote.html",
              "refsource": "MISC",
              "url": "http://blog.o0o.nu/2010/07/cve-2010-1870-struts2xwork-remote.html"
            },
            {
              "name": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140709-struts2",
              "refsource": "CONFIRM",
              "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140709-struts2"
            },
            {
              "name": "20100713 CVE-2010-1870: Struts2 remote commands execution",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2010/Jul/183"
            },
            {
              "name": "8345",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/8345"
            },
            {
              "name": "20201020 LISTSERV Maestro Remote Code Execution Vulnerability",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2020/Oct/23"
            },
            {
              "name": "http://packetstormsecurity.com/files/159643/LISTSERV-Maestro-9.0-8-Remote-Code-Execution.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/159643/LISTSERV-Maestro-9.0-8-Remote-Code-Execution.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2010-1870",
    "datePublished": "2010-08-17T17:31:00.000Z",
    "dateReserved": "2010-05-10T00:00:00.000Z",
    "dateUpdated": "2024-08-07T01:35:53.709Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.