CVE-2013-2135
Apache Struts 2.0.0-2.3.14.2 - Remote Code Execution via OGNL Double Evaluation
Title source: llmDescription
Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.
References (5)
Core 5
Core References
Vendor Advisory x_refsource_confirm
http://struts.apache.org/development/2.x/docs/s2-015.html
Vendor Advisory x_refsource_misc
https://cwiki.apache.org/confluence/display/WW/S2-015
Third Party Advisory x_refsource_confirm
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/64758
Third Party Advisory x_refsource_confirm
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
Scores
EPSS
0.1383
EPSS Percentile
96.1%
Details
CWE
CWE-94
Status
published
Products (3)
apache/struts
2.0.0 - 2.3.14.3
org.apache.struts/struts2-core
2.0.0 - 2.3.14.3Maven
org.apache.struts.xwork/xwork-core
2.0.0 - 2.3.14.3Maven
Published
Jul 16, 2013
Tracked Since
Feb 18, 2026