The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the # protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Struts | Apache | 2.0.0 (including) | 2.0.0 (including) |
| Struts | Apache | 2.0.1 (including) | 2.0.1 (including) |
| Struts | Apache | 2.0.2 (including) | 2.0.2 (including) |
| Struts | Apache | 2.0.3 (including) | 2.0.3 (including) |
| Struts | Apache | 2.0.4 (including) | 2.0.4 (including) |
| Struts | Apache | 2.0.5 (including) | 2.0.5 (including) |
| Struts | Apache | 2.0.6 (including) | 2.0.6 (including) |
| Struts | Apache | 2.0.7 (including) | 2.0.7 (including) |
| Struts | Apache | 2.0.8 (including) | 2.0.8 (including) |
| Struts | Apache | 2.0.9 (including) | 2.0.9 (including) |
| Struts | Apache | 2.0.10 (including) | 2.0.10 (including) |
| Struts | Apache | 2.0.11 (including) | 2.0.11 (including) |
| Struts | Apache | 2.0.11.1 (including) | 2.0.11.1 (including) |
| Struts | Apache | 2.0.11.2 (including) | 2.0.11.2 (including) |
| Struts | Apache | 2.0.12 (including) | 2.0.12 (including) |
| Struts | Apache | 2.0.13 (including) | 2.0.13 (including) |
| Struts | Apache | 2.0.14 (including) | 2.0.14 (including) |
| Struts | Apache | 2.1.0 (including) | 2.1.0 (including) |
| Struts | Apache | 2.1.1 (including) | 2.1.1 (including) |
| Struts | Apache | 2.1.2 (including) | 2.1.2 (including) |
| Struts | Apache | 2.1.3 (including) | 2.1.3 (including) |
| Struts | Apache | 2.1.4 (including) | 2.1.4 (including) |
| Struts | Apache | 2.1.5 (including) | 2.1.5 (including) |
| Struts | Apache | 2.1.6 (including) | 2.1.6 (including) |
| Struts | Apache | 2.1.8 (including) | 2.1.8 (including) |
| Struts | Apache | 2.1.8.1 (including) | 2.1.8.1 (including) |