Vulnerability record · CVE-2010-1870 · published 17 August 2010
CVE-2010-1870: Apache Struts 2 XWork OGNL whitelist bypass allows server-side context tampering
Apache · Struts
XWork in Struts 2.0.0 through 2.1.8.1 uses a permissive OGNL whitelist, letting remote attackers reach context variables such as #context, #_memberAccess and #root and bypass the ParameterInterceptors '#' protection. This is a distinct issue from CVE-2008-6504 and also affects products embedding the framework, such as Atlassian Fisheye and Crucible.
Description
The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the "#" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.
AV:N/AC:L/Au:N/C:N/I:P/A:N
Automated analysis
high priorityRemote, unauthenticated reachability plus a very high EPSS score and a public exploit outweigh the medium CVSS 2.0 rating.
What it is
XWork in Struts 2.0.0 through 2.1.8.1 uses a permissive OGNL whitelist, letting remote attackers reach context variables such as #context, #_memberAccess and #root and bypass the ParameterInterceptors '#' protection. This is a distinct issue from CVE-2008-6504 and also affects products embedding the framework, such as Atlassian Fisheye and Crucible.
Impact
An attacker can modify server-side OGNL context objects, which undermines the framework's expression protections and can lead to further server-side manipulation. The CVSS 2.0 vector records only partial integrity impact (I:P) with no confidentiality or availability impact.
Attack surface
Reachable over the network with no authentication and no user interaction per the AV:N/AC:L/Au:N vector, by sending crafted requests that supply OGNL context variables to a Struts 2 application.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.92015, 99.8th percentile) and a public Exploit-DB entry (14360) exists, indicating mature public exploitation.
What to do
- Upgrade Struts 2 past 2.1.8.1 to a fixed release per the Apache S2-005 advisory, and patch embedded copies in products such as Atlassian Fisheye and Crucible.
- If immediate upgrade is not possible, apply the ParameterInterceptor / OGNL whitelist hardening guidance from the S2-005 advisory.
- Inventory applications and libraries for Struts 2.0.0 through 2.1.8.1, including third-party products that bundle XWork.
- Restrict network exposure of Struts 2 applications and filter requests containing OGNL context variable names where feasible.
Detection
- Search web and WAF logs for request parameters containing OGNL context tokens such as #context, #_memberAccess, #root, #this, #_typeResolver or #_classResolver.
- Alert on requests that include '#' prefixed parameter names or OGNL expression syntax targeting Struts actions.
- Monitor for anomalous server-side errors or behavior changes following requests to Struts action endpoints.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2010-1870 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2010-1870), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
