CVE-2013-1966

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://struts.apache.org/development/2.x/docs/s2-013.htmlVendor Advisory
http://www.securityfocus.com/bid/60166Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=967656Third Party Advisory, VDB Entry
https://cwiki.apache.org/confluence/display/WW/S2-013Vendor Advisory
http://struts.apache.org/development/2.x/docs/s2-013.htmlVendor Advisory
http://www.securityfocus.com/bid/60166Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=967656Third Party Advisory, VDB Entry
https://cwiki.apache.org/confluence/display/WW/S2-013Vendor Advisory

Timeline

Published: Jul 10, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-19674.3Cross-site scripting (XSS) vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2, as used in ownCloud Server 5.0.x before CVE-2013-19685.5Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote authenticated users to cause a denial of service (FSFS repository corruption)CVE-2013-19697.5Multiple use-after-free vulnerabilities in libxml2 2.9.0 and possibly other versions might allow context-dependent attackers to cause a deni CVE-2013-19712.1Cross-site scripting (XSS) vulnerability in the MP3 Player module for Drupal 6.x allows remote authenticated users with certain permissions CVE-2013-19724.3Cross-site request forgery (CSRF) vulnerability in the elFinder file manager module 6.x-0.x before 6.x-0.8 and 7.x-0.x before 7.x-0.8 for Dr CVE-2013-19734.0The autocomplete callback in Autocomplete Widgets for Text and Number Fields (autocomplete_widgets) module 6.x-1.x before 6.x-1.4 and 7.x-1.CVE-2013-19766.9The (1) tomcat5, (2) tomcat6, and (3) tomcat7 init scripts, as used in the RPM distribution of Tomcat for JBoss Enterprise Web Server 1.0.2 CVE-2013-19772.1OpenStack devstack uses world-readable permissions for keystone.conf, which allows local users to obtain sensitive information such as the L CVE-2013-19786.8Heap-based buffer overflow in the read_xwd_cols function in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.6.9 and earlier allows r CVE-2013-19796.9The scm_set_cred function in include/net/scm.h in the Linux kernel before 3.8.11 uses incorrect uid and gid values during credentials passin CVE-2013-19806.8Buffer overflow in the get_dsmp function in loaders/masi_load.c in libxmp before 4.1.0 allows remote attackers to execute arbitrary code via CVE-2013-19816.8Multiple integer overflows in X.org libX11 1.5.99.901 (1.6 RC1) and earlier allow X servers to trigger allocation of insufficient memory and