Skip to content

Improper Control of Generation of Code in Apache Struts

High severity GitHub Reviewed Published May 14, 2022 to the GitHub Advisory Database • Updated Mar 5, 2024

Package

maven org.apache.struts:struts2-core (Maven)

Affected versions

< 2.3.14.3

Patched versions

2.3.14.3

Description

Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.

References

Published by the National Vulnerability Database Jul 10, 2013
Published to the GitHub Advisory Database May 14, 2022
Reviewed Jul 8, 2022
Last updated Mar 5, 2024

Severity

High

EPSS score

0.813%
(82nd percentile)

Weaknesses

CVE ID

CVE-2013-1965

GHSA ID

GHSA-whmq-v94q-34p9

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.