logo

Database

Server side template injection In org.apache.struts:struts2-core

Description

Improper Control of Generation of Code in Apache Struts Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2013-19652. NVD-2013-19653. OSV-2013-19654. GCVE-2013-1965

References

1. http://struts.apache.org/docs/s2-012.html2. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-1965.yaml3. https://github.com/cinno/CVE-2013-19654. https://github.com/apache/struts/commit/7e6f641ebb142663cbd1653dc49bed725edf7f565. https://bugzilla.redhat.com/show_bug.cgi?id=9676556. https://web.archive.org/web/20140227231557/http://www.securityfocus.com/bid/600827. http://struts.apache.org/development/2.x/docs/s2-012.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.