Arbitrary Code Execution Affecting org.apache.struts.xwork:xwork-core package, versions [2,2.3.14.1)
Threat Intelligence
Exploit Maturity
Mature
EPSS
1.86% (89th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHESTRUTSXWORK-30794
- published 8 Jun 2014
- disclosed 10 Jul 2013
- credit Unknown
Introduced: 10 Jul 2013
CVE-2013-1966 Open this link in a new tabOverview
org.apache.struts.xwork:xwork-core
Apache Struts 2 before 2.3.14.1 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.
References
CVSS Scores
version 3.1