Code injection in Apache Struts · CVE-2013-4316 · GitHub Advisory Database · GitHub

Code injection in Apache Struts

High severity GitHub Reviewed Published May 17, 2022 to the GitHub Advisory Database • Updated Dec 28, 2023

Package

org.apache.struts:struts2-core (Maven)

Affected versions

>= 2.0.0, < 2.3.15.2

Patched versions

2.3.15.2

org.apache.struts:struts2-rest-plugin (Maven)

>= 2.0.0, < 2.3.15.2

2.3.15.2

Description

Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.

References

Published by the National Vulnerability Database

Sep 30, 2013

Published to the GitHub Advisory Database May 17, 2022

Reviewed Nov 3, 2022

Last updated Dec 28, 2023