CVE-2013-1965

Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.

CVSS v2.0

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

93.53% chance of exploitation in the next 30 days, 100th percentile

Nuclei

critical · CWE-94

Published

2013-07-10

Updated

2024-08-06

Proof-of-concept exploits (1)

• cinno/CVE-2013-19651★ · 2015-06-02

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-1965.yaml

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2013/CVE-2013-1965.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2015-7755
• CVE-2013-1959
• CVE-2013-1966
• CVE-2013-1950
• CVE-2013-1967
• CVE-2013-1942