Arbitrary Code Execution Affecting com.opensymphony:xwork-core package, versions [2.1.4,2.1.6)
Snyk CVSS
Attack Complexity
Low
User Interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Threat Intelligence
Exploit Maturity
Mature
EPSS
1.86% (89th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-COMOPENSYMPHONY-30328
- published 27 May 2013
- disclosed 27 May 2013
- credit The Struts Team
Introduced: 27 May 2013
CVE-2013-1966 Open this link in a new tabOverview
com.opensymphony:xwork-core
is an command-pattern framework that is used to power WebWork as well as other applications. XWork provides an Inversion of Control container, a powerful expression language, data type conversion, validation, and pluggable configuration.
Apache Struts 2 before 2.3.14.1 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.