CVE-2008-6504
Improper Input Validation in OpenSymphony XWork
ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.
Exploit likelihood
What each source reports
NVD Score used
ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.
- Record
CVE-2008-6504- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.
- Record
CVE-2008-6504- Updated
- 2026-11-02
EUVDEUVD-2022-5677 No score
ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.
- Record
EUVD-2022-5677- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wxw2-2mx5-c5qf No score
Improper Input Validation in OpenSymphony XWork
ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.
- Record
GHSA-wxw2-2mx5-c5qf- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-wxw2-2mx5-c5qf No score
Improper Input Validation in OpenSymphony XWork
ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.
- Record
GHSA-wxw2-2mx5-c5qf- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.opensymphony:xworkMaven |
before 2.0.6 | 2.0.6 |
com.opensymphony:xworkMaven |
2.1.0 up to 2.1.2 | 2.1.2 |
com.opensymphony:xworkMaven |
before 2.0.6, plus listed versions 2.0.42.0.5 |
2.0.6 |
com.opensymphony:xworkMaven |
2.1.0 up to 2.1.2, plus listed versions 2.1.1 |
2.1.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | XWork < 2.0.11.2 - 'ParameterInterceptor' Class OGNL Security Bypass | 2008-11-04 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-6504 is a medium vulnerability (CVSS 5.0) in Apache Struts, published March 23, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 38.6%, the 98th percentile. Fixed in com.opensymphony:xwork 2.0.6.
References
secunia.com/advisories/32495
fisheye6.atlassian.com/cru/CR-9
struts.apache.org/2.x/docs/s2-003.html
exchange.xforce.ibmcloud.com/vulnerabilities/46328
vupen.com/english/advisories/2008/3003
Show 9 moreShow less
securityfocus.com/bid/32101
jira.opensymphony.com/browse/XW-641
issues.apache.org/struts/browse/WW-2692
osvdb.org/49732
nvd.nist.gov/vuln/detail/CVE-2008-6504
web.archive.org/web/20081119232431/jira.opensymphony.com/browse/XW-641
github.com/advisories/GHSA-wxw2-2mx5-c5qf