Skip to content
Fencer Vulns
medium 6.8

CVE-2007-4556 json

OpenSymphony XWork vulnerable to improper input validation

published 2007-08-28 19 y ago modified 2026-06-16 4 mo ago also GHSA-h7mf-qrm9-2848 , EUVD-2022-4099

cvss
6.8
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
25.7%
EPSS 25.7% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known, plus a Nuclei check

Summary

Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character.

Patch / fix

  • maven opensymphony:xwork 1.2.3, 2.0.4
  • opensymphony xwork 1.2.3

Exploit prediction

25.75% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template OpenSymphony XWork/Apache Struts2 - Remote Code Execution nuclei detection template

CVSS scores

assigned by version score vector
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected packages

ecosystem package affected fixed in
maven opensymphony:xwork
<1.2.3
>=2.0.0, <2.0.4
1.2.3
2.0.4

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.