CVE-2013-1966

Apache Struts < 2.3.14.1 - Code Injection

Title source: rule

Description

Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.

Exploits (2)

metasploit WORKING POC GREAT

by Coverity security Research Laboratory, NSFOCUS Security Team, Eric Kobrin, Douglas Rodrigues · rubypocwin

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_include_params.rb

View Code ZIP pw:eip

exploitdb WORKING POC

rubyremotemultiple

https://www.exploit-db.com/exploits/25980

View Code ZIP pw:eip

References (4)

[Vendor Advisory] http://struts.apache.org/development/2.x/docs/s2-013.html

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/60166

[Third Party Advisory, VDB Entry] https://bugzilla.redhat.com/show_bug.cgi?id=967656

[Vendor Advisory] https://cwiki.apache.org/confluence/display/WW/S2-013

Scores

EPSS 0.9110

EPSS Percentile 99.6%

Details

CWE

CWE-94

Status published

Products (3)

apache/struts 2.0.0 - 2.3.14.1

org.apache.struts/struts2-core 2.0.0 - 2.3.14.2Maven

org.apache.struts.xwork/xwork-core 2.0.0 - 2.3.14.2Maven

Published Jul 10, 2013

Tracked Since Feb 18, 2026