{"id":"CVE-2013-2135","published":"2013-07-16T18:00:00Z","modified":"2024-08-06T15:27:40Z","title":"Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted…","vendor":null,"product":null,"tier":"tail","description":{"text":"Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both \"${}\" and \"%{}\" sequences, which causes the OGNL code to be evaluated twice.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.13828,"percentile":0.96508,"provenance":"source"},"cwes":[],"references":[{"url":"http://struts.apache.org/development/2.x/docs/s2-015.html","tags":["x_refsource_CONFIRM"]},{"url":"https://cwiki.apache.org/confluence/display/WW/S2-015","tags":["x_refsource_MISC"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/64758","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html","tags":["x_refsource_CONFIRM"]}],"priority":{"score":19.3,"factors":[{"name":"EPSS percentile","points":19.3}]},"affected":[{"ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.0.0, <2.3.14.3"],"patched":["2.3.14.3"],"from":["GHSA-pw8r-x2qm-3h5m"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.struts.xwork:xwork-core","vulnerableRanges":[">=2.0.0, <2.3.14.3"],"patched":["2.3.14.3"],"from":["GHSA-pw8r-x2qm-3h5m"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-4835","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-struts-cve-2013-2134","children":[{"from":"CVE-2013-2135","to":"CVE-2018-11776","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/src/main/java/org/apache/struts2/StrutsConstants.java","core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java"],"commits":["https://github.com/apache/struts/commit/01e6b251b4db78bfb7971033652e81d1af4cb3e0","https://github.com/apache/struts/commit/041206d2a693d02c0cb2e72765275e55ba14049f","https://github.com/apache/struts/commit/6e87474f9ad0549f07dd2c37d50a9ccd0977c6e5"],"basis":"shared function","functions":["parseNameAndNamespace","setAlwaysSelectFullNamespace"]}]}],"packageHistory":[{"cve":"CVE-2013-2115","published":"2013-07-10","fixed":"2.3.14.2","kev":false,"link":{"from":"CVE-2013-2115","to":"CVE-2013-2135","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts:struts2-core","fromFixed":"2.3.14.2","toFixed":"2.3.14.3","daysApart":6},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts.xwork:xwork-core","fromFixed":"2.3.14.2","toFixed":"2.3.14.3","daysApart":6}]}},{"cve":"CVE-2013-1965","published":"2013-07-10","fixed":"2.3.14.3","kev":false},{"cve":"CVE-2013-2134","published":"2013-07-16","fixed":"2.3.14.3","kev":false},{"cve":"CVE-2013-2135","published":"2013-07-16","fixed":"2.3.14.3","kev":false},{"cve":"CVE-2013-2248","published":"2013-07-18","fixed":"2.3.15.1","kev":false,"link":{"from":"CVE-2013-2135","to":"CVE-2013-2248","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts:struts2-core","fromFixed":"2.3.14.3","toFixed":"2.3.15.1","daysApart":2},{"kind":"same-code","provenance":"machine","files":["core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java"],"commits":["https://github.com/apache/struts/commit/01e6b251b4db78bfb7971033652e81d1af4cb3e0","https://github.com/apache/struts/commit/041206d2a693d02c0cb2e72765275e55ba14049f","https://github.com/apache/struts/commit/3cfe34fefedcf0fdcfcb061c0aea34a715b7de63","https://github.com/apache/struts/commit/630e1ba065a8215c4e9ac03bfb09be9d655c2b6e"],"basis":"shared file"}]}},{"cve":"CVE-2013-2251","published":"2013-07-20","fixed":"2.3.15.1","kev":true,"link":{"from":"CVE-2013-2135","to":"CVE-2013-2251","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts:struts2-core","fromFixed":"2.3.14.3","toFixed":"2.3.15.1","daysApart":4},{"kind":"same-code","provenance":"machine","files":["core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java"],"commits":["https://github.com/apache/struts/commit/01e6b251b4db78bfb7971033652e81d1af4cb3e0","https://github.com/apache/struts/commit/041206d2a693d02c0cb2e72765275e55ba14049f","https://github.com/apache/struts/commit/3cfe34fefedcf0fdcfcb061c0aea34a715b7de63","https://github.com/apache/struts/commit/630e1ba065a8215c4e9ac03bfb09be9d655c2b6e"],"basis":"shared file"},{"kind":"similar","provenance":"machine","score":0.39,"basis":"same package + description similarity"}]}},{"cve":"CVE-2013-4316","published":"2013-09-30","fixed":"2.3.15.2","kev":false},{"cve":"CVE-2014-0094","published":"2014-03-10","fixed":"2.3.16.2","kev":false,"link":{"from":"CVE-2013-2135","to":"CVE-2014-0094","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts.xwork:xwork-core","fromFixed":"2.3.14.3","toFixed":"2.3.16.2","daysApart":237}]}}],"package":"Maven:org.apache.struts:struts2-core"}}