CVE-2013-2115

Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the…

published July 10, 2013

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.5th percentile for exploit probability.

CVSS
—
EPSS
75%
Percentile
99.5
In the wild
Unconfirmed
What it is

Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.74636 · 99.5th percentile
Published
2013-07-10T19:00Z
EPSS history
Timeline
  • 10 JUL 19:00Z
    Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the…
    cvelistv5