Arbitrary code execution in Apache Struts 2

CRITICAL 9.3CVE-2013-2135 · GHSA-pw8r-x2qm-3h5m · Published 16/07/2013 · updated 16/06/2026

Package	Affected versions	Patched versions
org.apache.struts.xwork:xwork-core Maven	`≥ 2.0.0, < 2.3.14.3`	`2.3.14.3`
org.apache.struts:struts2-core Maven	`≥ 2.0.0, < 2.3.14.3`	`2.3.14.3`
struts apache	`≥ 2.0.0, < 2.3.14.3`	`2.3.14.3`

Description

Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2013-2135 · ADVISORY
apache/struts commit 01e6b25 · WEB
apache/struts commit 041206d · WEB
apache/struts commit 113c470 · WEB
apache/struts commit 54e5c91 · WEB
apache/struts commit 711cf02 · WEB
apache/struts commit 8b4fc81 · WEB
apache/struts commit cfb6e9a · WEB
cwiki.apache.org/confluence/display/WW/S2-015 · WEB
apache/struts · PACKAGE
issues.apache.org/jira/browse/WW-4090 · WEB
issues.apache.org/jira/browse/WW-4094 · WEB
issues.apache.org/jira/browse/WW-4095 · WEB
web.archive.org/web/20140410223942/http://www.securityfocus.com/bid/64758 · WEB
struts.apache.org/development/2.x/docs/s2-015.html · WEB
oracle.com/technetwork/topics/security/cpujan2014-1972949.html · WEB
oracle.com/technetwork/topics/security/cpuoct2013-1899837.html · WEB
securityfocus.com/bid/64758 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free