CVE-2013-4212: Code Injection
Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol, which uses a subclass of UIAction, aka "OGNL Injection."
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4212?
CVE-2013-4212 has a high severity rating due to the potential for remote code execution.
How do I fix CVE-2013-4212?
To fix CVE-2013-4212, upgrade Apache Roller to version 5.0.2 or later.
What versions of Apache Roller are affected by CVE-2013-4212?
CVE-2013-4212 affects Apache Roller versions prior to 5.0.2, including 4.0, 4.0.1, and 5.0.
What types of attacks can be executed via CVE-2013-4212?
CVE-2013-4212 allows attackers to execute arbitrary OGNL expressions through certain parameters.
Is there a workaround for CVE-2013-4212 if I cannot upgrade?
There is no official workaround for CVE-2013-4212, so upgrading is strongly recommended.