CVE-2013-2135: Code Injection
Published Jul 16, 2013
·Updated
Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.
Affected Software
3 affected componentsFixes available
maven/org.apache.struts.xwork:xwork-core>=2.0.0<2.3.14.3
2.3.14.3
maven/org.apache.struts:struts2-core>=2.0.0<2.3.14.3
2.3.14.3
Apache struts>=2.0.0<2.3.14.3
Event History
Jul 16, 2013
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
May 14, 2022
Advisory Published
01:57 AM
Frequently Asked Questions
1
What is the severity of CVE-2013-2135?
CVE-2013-2135 has a high severity rating due to its capability to allow remote code execution.
2
How do I fix CVE-2013-2135?
To fix CVE-2013-2135, upgrade to Apache Struts version 2.3.14.3 or later.
3
What type of attack does CVE-2013-2135 allow?
CVE-2013-2135 allows remote attackers to execute arbitrary OGNL code.
4
Which versions of Apache Struts are affected by CVE-2013-2135?
Apache Struts versions prior to 2.3.14.3 are affected by CVE-2013-2135.
5
What are the implications of CVE-2013-2135?
Successful exploitation of CVE-2013-2135 can lead to full control of the affected application server.