Staging Environment: Content and features may be unstable or change without notice.

Advisory Weakness Curation

CVE-2013-2135

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-pw8r-x2qm-3h5m

Arbitrary code execution in Apache Struts 2 Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.

gitlab/maven/org.apache.struts/struts2-core/CVE-2013-2135

Arbitrary OGNL code execution via double evaluation This package allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both `${}` and `%{}` sequences, which causes the OGNL code to be evaluated twice.

gitlab/maven/org.apache.struts/struts2-el/CVE-2013-2135

Code Injection Apache Struts allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both `${}` and `%{}` sequences, which causes the OGNL code to be evaluated twice.

gitlab/maven/org.apache.struts.xwork/xwork-core/CVE-2013-2135

Improper Control of Generation of Code ('Code Injection') Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.