Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.apache.struts/struts2-core@2.3.14.1
Typemaven
Namespaceorg.apache.struts
Namestruts2-core
Version2.3.14.1
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version2.3.31
Latest_non_vulnerable_version7.1.1
Affected_by_vulnerabilities
0
url VCID-4x3k-a11x-7bee
vulnerability_id VCID-4x3k-a11x-7bee
summary 
Remote command execution due to flaw in the includeParams attribute of URL and Anchor tags
This package allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the `includeParams` attribute in the URL or A tag.
references
0
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=967656
reference_id
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=967656
1
reference_url https://cwiki.apache.org/confluence/display/WW/S2-013
reference_id
reference_type
scores
url https://cwiki.apache.org/confluence/display/WW/S2-013
2
reference_url https://github.com/apache/struts/commit/7e6f641ebb142663cbd1653dc49bed725edf7f56
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/7e6f641ebb142663cbd1653dc49bed725edf7f56
3
reference_url http://struts.apache.org/development/2.x/docs/s2-013.html
reference_id
reference_type
scores
url http://struts.apache.org/development/2.x/docs/s2-013.html
4
reference_url http://struts.apache.org/docs/s2-013.html
reference_id
reference_type
scores
url http://struts.apache.org/docs/s2-013.html
5
reference_url http://struts.apache.org/docs/s2-014.html
reference_id
reference_type
scores
url http://struts.apache.org/docs/s2-014.html
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-1966
reference_id CVE-2013-1966
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2013-1966
7
reference_url https://github.com/advisories/GHSA-737w-mh58-cxjp
reference_id GHSA-737w-mh58-cxjp
reference_type
scores
url https://github.com/advisories/GHSA-737w-mh58-cxjp
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.14.2
purl pkg:maven/org.apache.struts/struts2-core@2.3.14.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1kjb-use6-23eu
1
vulnerability VCID-447s-4ag7-gyes
2
vulnerability VCID-89az-256b-mubw
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.14.2
aliases CVE-2013-1966, GHSA-737w-mh58-cxjp
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-4x3k-a11x-7bee
1
url VCID-wsvw-qwt7-qbg1
vulnerability_id VCID-wsvw-qwt7-qbg1
summary 
Remote command execution due to flaw in the includeParams attribute of URL and Anchor tags
This package allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the URL or A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.
references
0
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=967656
reference_id
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=967656
1
reference_url https://cwiki.apache.org/confluence/display/WW/S2-013
reference_id
reference_type
scores
url https://cwiki.apache.org/confluence/display/WW/S2-013
2
reference_url https://cwiki.apache.org/confluence/display/WW/S2-014
reference_id
reference_type
scores
url https://cwiki.apache.org/confluence/display/WW/S2-014
3
reference_url https://github.com/apache/struts/commit/d7804297e319c7a12245e1b536e565fcea6d650
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/d7804297e319c7a12245e1b536e565fcea6d650
4
reference_url https://github.com/apache/struts/commit/d934c6e7430b7b98e43a0a085a2304bd31a75c3d
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/d934c6e7430b7b98e43a0a085a2304bd31a75c3d
5
reference_url https://github.com/apache/struts/commit/ea96d18d0f75c390d2595648efa3563785c272c6
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/ea96d18d0f75c390d2595648efa3563785c272c6
6
reference_url https://github.com/apache/struts/commit/fed4f8e8a4ec69b5e7612b92d8ce3e476680474
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/fed4f8e8a4ec69b5e7612b92d8ce3e476680474
7
reference_url https://issues.apache.org/jira/browse/WW-4063
reference_id
reference_type
scores
url https://issues.apache.org/jira/browse/WW-4063
8
reference_url http://struts.apache.org/development/2.x/docs/s2-014.html
reference_id
reference_type
scores
url http://struts.apache.org/development/2.x/docs/s2-014.html
9
reference_url http://struts.apache.org/docs/s2-014.html
reference_id
reference_type
scores
url http://struts.apache.org/docs/s2-014.html
10
reference_url https://web.archive.org/web/20140212000331/http://www.securityfocus.com/bid/60167
reference_id
reference_type
scores
url https://web.archive.org/web/20140212000331/http://www.securityfocus.com/bid/60167
11
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-2115
reference_id CVE-2013-2115
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2013-2115
12
reference_url https://github.com/advisories/GHSA-7ghm-rpc7-p7g5
reference_id GHSA-7ghm-rpc7-p7g5
reference_type
scores
url https://github.com/advisories/GHSA-7ghm-rpc7-p7g5
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.14.2
purl pkg:maven/org.apache.struts/struts2-core@2.3.14.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1kjb-use6-23eu
1
vulnerability VCID-447s-4ag7-gyes
2
vulnerability VCID-89az-256b-mubw
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.14.2
aliases CVE-2013-2115, GHSA-7ghm-rpc7-p7g5
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-wsvw-qwt7-qbg1
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.14.1