Описание
Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol, which uses a subclass of UIAction, aka "OGNL Injection."
Ссылки
- Patch
- Vendor Advisory
- Vendor Advisory
- Exploit
- Patch
- Vendor Advisory
- Vendor Advisory
- Exploit
Уязвимые конфигурации
Конфигурация 1Версия до 5.0.1 (включая)
Одно из
cpe:2.3:a:apache:roller:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:roller:4.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:roller:4.0.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:roller:5.0:*:*:*:*:*:*:*
EPSS
Процентиль: 99%
0.87107
Высокий
6.8 Medium
CVSS2
Дефекты
CWE-94
Связанные уязвимости
github
больше 3 лет назад
Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol, which uses a subclass of UIAction, aka "OGNL Injection."
EPSS
Процентиль: 99%
0.87107
Высокий
6.8 Medium
CVSS2
Дефекты
CWE-94