logo

Database

Server side template injection In org.apache.struts.xwork:xwork-core

Description

Arbitrary code execution in Apache Struts Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2013-19662. NVD-2013-19663. OSV-2013-19664. GCVE-2013-1966

References

1. https://github.com/apache/struts/commit/7e6f641ebb142663cbd1653dc49bed725edf7f562. https://bugzilla.redhat.com/show_bug.cgi?id=9676563. https://cwiki.apache.org/confluence/display/WW/S2-0134. http://struts.apache.org/development/2.x/docs/s2-013.html5. https://www.exploit-db.com/exploits/259806. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_include_params.rb

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.