Vulnerability Details : CVE-2013-1965

Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.

Published 2013-07-10 19:55:05

Updated 2019-08-12 21:15:12

Source Red Hat, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2013-1965

Probability of exploitation activity in the next 30 days: 0.81%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 80 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2013-1965

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	[email protected]
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2013-1965

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Assigned by: [email protected] (Primary)

References for CVE-2013-1965

https://bugzilla.redhat.com/show_bug.cgi?id=967655

Third Party Advisory;VDB Entry
http://www.securityfocus.com/bid/60082

Third Party Advisory
http://struts.apache.org/development/2.x/docs/s2-012.html

Vendor Advisory

Products affected by CVE-2013-1965

Apache » Struts
Versions from including (>=) 2.0.0 and before (<) 2.3.14.1
cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*
Matching versions
Apache » Struts2-showcase
Versions from including (>=) 2.0.0 and up to, including, (<=) 2.3.13
cpe:2.3:a:apache:struts2-showcase:*:*:*:*:*:*:*:*
Matching versions