CVE-2013-2115: Improper Control of Generation of Code ('Code Injection')
(updated )
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.
References
- struts.apache.org/development/2.x/docs/s2-014.html
- bugzilla.redhat.com/show_bug.cgi?id=967656
- cwiki.apache.org/confluence/display/WW/S2-013
- cwiki.apache.org/confluence/display/WW/S2-014
- github.com/advisories/GHSA-7ghm-rpc7-p7g5
- github.com/apache/struts/commit/d7804297e319c7a12245e1b536e565fcea6d650
- github.com/apache/struts/commit/d934c6e7430b7b98e43a0a085a2304bd31a75c3d
- github.com/apache/struts/commit/ea96d18d0f75c390d2595648efa3563785c272c6
- github.com/apache/struts/commit/fed4f8e8a4ec69b5e7612b92d8ce3e476680474
- issues.apache.org/jira/browse/WW-4063
- nvd.nist.gov/vuln/detail/CVE-2013-2115
- web.archive.org/web/20140212000331/http://www.securityfocus.com/bid/60167
Code Behaviors & Features
Detect and mitigate CVE-2013-2115 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →