CVE-2013-2134: Code Injection
Published Jul 16, 2013
·Updated
Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.
Affected Software
3 affected componentsFixes available
maven/org.apache.struts.xwork:xwork-core>=2.0.0<2.3.14.3
2.3.14.3
maven/org.apache.struts:struts2-core>=2.0.0<2.3.14.3
2.3.14.3
Apache struts>=2.0.0<2.3.14.3
Event History
Jul 16, 2013
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
May 14, 2022
Advisory Published
01:57 AM
Frequently Asked Questions
1
What is the severity of CVE-2013-2134?
CVE-2013-2134 is classified as a critical vulnerability that allows remote attackers to execute arbitrary OGNL code.
2
How do I fix CVE-2013-2134?
To fix CVE-2013-2134, you should upgrade to Apache Struts version 2.3.14.3 or later.
3
What products are affected by CVE-2013-2134?
CVE-2013-2134 affects Apache Struts versions prior to 2.3.14.3.
4
Can CVE-2013-2134 be exploited remotely?
Yes, CVE-2013-2134 can be exploited remotely by attackers through crafted requests.
5
What type of code can be executed due to CVE-2013-2134?
CVE-2013-2134 allows for the execution of arbitrary OGNL (Object-Graph Navigation Language) code.