Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted…
Official description · CVE.orgSource dataSource dataCopied from an authoritative feed: NVD, CVE.org, CISA KEV, FIRST EPSS or MITRE CTID mappings, or labelled by the annotators of a published dataset. Copied from CVE.org.
Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown.Breakdown
59.9 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 12 years after disclosure. Public exploit code (Exploit-DB) was available 41 days before disclosure.
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
8 related vulnerabilities in the same code over 5 years. The latest fix listed for struts2-core is 2.3.15.1.
Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.
This CVECVE-2013-2134Struts 2 before 2.3.14.3 allows remote attackers to execute…16 Jul 2013
same family
CVE-2013-2135Struts 2 before 2.3.14.3 allows remote attackers to execute…16 Jul 2013
Next fix in the same packageHigh
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
Fixed one release later2.3.14.3 → 2.3.15.1 (org.apache.struts:struts2-core)
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
CVE-2013-4310Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass…30 Sep 2013
relatedHigh
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
Fixed one release later2.3.15.2 → 2.3.15.3 (org.apache.struts:struts2-core)
CVE-2013-4316Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation…30 Sep 2013
relatedMedium
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
CVE-2016-4438The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1…4 Jul 2016
relatedMedium
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linked
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSVSourceSource dataCopied from an authoritative feed: NVD, CVE.org, CISA KEV, FIRST EPSS or MITRE CTID mappings, or labelled by the annotators of a published dataset. GitHub Security Advisories and OSV.
2 packages in 1 ecosystem. Main package: org.apache.struts:struts2-core.