Read the docs

Opensymphony

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Opensymphony records in CISA KEV

No Opensymphony vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Xwork 4 records MEDIUM Webwork 2 records LOW

Records

4 records in Xwork · all components

TI-2007-04411 CVE-2007-4556 · GHSA-h7mf-qrm9-2848

Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in…

Priority MEDIUM 52

Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is en…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.25749 Published 2007-08-28 Fixed in 1.2.3, 2.0.4 CWE-20
TI-2008-06194 CVE-2008-6504 · GHSA-wxw2-2mx5-c5qf

ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as…

Priority MEDIUM 50

ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows re…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.38579 Published 2009-03-23 Fixed in 2.0.6, 2.1.2 CWE-20
TI-2011-01551 CVE-2011-1772 · GHSA-56f8-g68r-j699

Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before…

Priority LOW 38

Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors in…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.33346 Published 2011-05-13 Partial fix · 2.2.3 CWE-79
TI-2011-01813 CVE-2011-2088 · GHSA-9ccm-g362-2r35

XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork…

Priority LOW 32

XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit el…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0614 Published 2011-05-13 Partial fix · 2.2.2 CWE-200
Open these records in search →