Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in…
Priority MEDIUM 52CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub.
Summary
Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character.
Why it matters now
EPSS 0.25749 97th percentileScored 2026-11-07
Fix Fixed opensymphony:xwork (Maven): 1.2.3, 2.0.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | opensymphony:xwork (Maven) | before 1.2.3 | 1.2.3 | Patch available | GHSA-h7mf-qrm9-2848 |
| — | opensymphony:xwork (Maven) | 2.0.0 to before 2.0.4 | 2.0.4 | Patch available | GHSA-h7mf-qrm9-2848 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- opensymphony:xwork (Maven) Vendor— Affected before 1.2.3 Fixed in 1.2.3 Patch available GHSA-h7mf-qrm9-2848
- opensymphony:xwork (Maven) Vendor— Affected 2.0.0 to before 2.0.4 Fixed in 2.0.4 Patch available GHSA-h7mf-qrm9-2848
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:opensymphony:xwork:*:*:*:*:*:*:*:* | before 1.2.3; 2.0.0 – 2.0.4 | Vulnerable | Opensymphony |
- cpe:2.3:a:opensymphony:xwork:*:*:*:*:*:*:*:* Versions before 1.2.3; 2.0.0 – 2.0.4 Vulnerable ·Opensymphony
Remediation
- Fix · GHSA-h7mf-qrm9-2848 opensymphony:xwork (Maven) Fixed in 1.2.3 Advisory →
- Fix · GHSA-h7mf-qrm9-2848 opensymphony:xwork (Maven) Fixed in 2.0.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2007-4556
- 2026-10-03 Alias added: GHSA-h7mf-qrm9-2848
References
Patch 2
Advisory 8
- http://jira.opensymphony.com/browse/XW-544
- http://issues.apache.org/struts/browse/WW-2030
- ADV-2007-3041
- ADV-2007-3042
- http://wiki.opensymphony.com/display/WW/1.2.3+Press+Release
- http://jira.opensymphony.com/secure/ReleaseNote.jspa?projectId=10050&styleName=Html&version=21706
- http://jira.opensymphony.com/secure/ReleaseNote.jspa?projectId=10050&styleName=Html&version=21701
- https://nvd.nist.gov/vuln/detail/CVE-2007-4556
Other 1
More Opensymphony Xwork vulnerabilities
- TI-2008-06194 ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as… CVSS 2.0MEDIUM 5.0
- TI-2011-01551 Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before… CVSS 2.0LOW 2.6
- TI-2011-01813 XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2007-4556 · CVE Program
- CVE-2007-4556 · NVD
- FIRST EPSS
- GHSA-h7mf-qrm9-2848 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences