Patchfirst
Patchfirst
CVE-2013-1965 Public exploit EPSS 93.5%

Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to…

Summary

The flaw is in the Apache Struts Showcase App, a component of Apache Struts 2 affecting versions 2.0.0 through 2.3.13 (and Struts 2 releases before 2.3.14.3), where a crafted parameter name is not properly handled when a redirect is invoked.

Official description · CVE.org

Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.

Breakdown
25.0 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Public exploit code (PoC-in-GitHub) appeared 23 months after disclosure. No confirmed exploitation is recorded.

  1. Disclosedday 0
  2. Public exploit codePoC-in-GitHub+23 mo

See the family tree

A fix was bypassed or incomplete once over 4 years. The latest fix listed for struts2-core is 2.3.15.1.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. This CVECVE-2013-1965Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2…10 Jul 2013
  2. same family
    CVE-2013-1966Struts 2 before 2.3.14.2 allows remote attackers to execute…10 Jul 2013
  3. incomplete fixHigh

    Why these are linked:

    • Stated in the CVE textNOTE: this issue is due to an incomplete fix for CVE-2013-1966.
    • Similar weakness in the same product (machine-matched)same package + description similarity
    CVE-2013-2115Struts 2 before 2.3.14.2 allows remote attackers to execute…10 Jul 2013
  4. same family
    CVE-2017-9787When using a Spring AOP functionality to secure Struts actions…13 Jul 2017

Fixes in struts2-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 2.3.4.1CVE-2012-43865 Sep 2012
  2. 2.3.14.2CVE-2013-196610 Jul 2013
  3. 2.3.14.2CVE-2013-211510 Jul 2013
  4. 2.3.14.3CVE-2013-196510 Jul 2013
  5. 2.3.14.3CVE-2013-213416 Jul 2013
  6. 2.3.14.3CVE-2013-213516 Jul 2013
  7. 2.3.15.1CVE-2013-224818 Jul 2013Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.struts:struts2-core.

Mavenorg.apache.struts:struts2-coreGHSA-whmq-v94q-34p9

Upgrade to 2.5.33

Fixes this CVE and 23 other known vulnerabilities in this package (CVE-2008-6505, CVE-2010-1870, +21).

Still affected on this line by CVE-2024-53677 (fixed in 6.4.0, a newer line); CVE-2025-68493 (no fix published).

Set the version to 2.5.33 or later in your pom.xml or build.gradle.

First fixed in 2.3.14.3 for CVE-2013-1965.

Affected versions

If you runUpgrade to
All versions before 2.3.14.32.5.33first fix for this CVE: 2.3.14.3

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

3 links, grouped by NVD tag

x_refsource_CONFIRM 1

struts.apache.org/development/2.x/docs/s2-012.html

x_refsource_MISC 1

bugzilla.redhat.com/show_bug.cgi?id=967655

vdb-entry 1

securityfocus.com/bid/60082
↑ ↓ chooseEnter openEsc close