Unscored severity · published Sep 30, 2013
CVE-2013-4316
Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors
–
CVSS
8.4%
EPSS
No
On KEV
Description
Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)8.4% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
Struts · Apache
2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more · source: NVD
FP
Flexcube Private Banking · Oracle
1.7; 2.0; 2.0.1; 2.2.0.1; 3.0; 12.0.1; +1 more · source: NVD
ME
Mysql Enterprise Monitor · Oracle
through 2.3.14; through 3.0.4 · source: NVD
WS
Webcenter Sites · Oracle
11.1.1.6.1; 11.1.1.8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-4316
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-4316
Patch
http://archives.neohapsis.com/archives/bugtraq/2013-09/0107.html
Patch
http://struts.apache.org/release/2.3.x/docs/s2-019.html
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
Third Party Advisory
http://www.securityfocus.com/bid/64758
Third Party Advisory
http://www.securitytracker.com/id/1029078
More from Struts
9.8
CVE-2020-17530
Apache Struts Remote Code Execution Vulnerability
9.8
CVE-2017-9791
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage
9.8
CVE-2017-5638
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload…
9.8
CVE-2013-2251
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction:…
9.8
CVE-2012-0391
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of…