Arbitrary code execution in Apache Struts

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2013-1966 · ADVISORY
• apache/struts commit 7e6f641 · WEB
• bugzilla.redhat.com/show_bug.cgi · WEB
• cwiki.apache.org/confluence/display/WW/S2-013 · WEB
• apache/struts · PACKAGE
• struts.apache.org/development/2.x/docs/s2-013.html · WEB
• securityfocus.com/bid/60166 · Third Party Advisory

Lỗ hổng khác của org.apache.struts.xwork:xwork-core

• CVE-2025-68493CAO 8.1Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Str…
• CVE-2016-4433CAO 7.5Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a…
• CVE-2016-4430CAO 8.8Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CS…
• CVE-2015-1831CAO 7.5The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application"…
• CVE-2014-0094TRUNG BÌNH 5.0The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, …