CVE-2013-4316

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-16 CWE-284

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2013-09/0107.htmlPatch
http://struts.apache.org/release/2.3.x/docs/s2-019.htmlPatch, Vendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.htmlThird Party Advisory
http://www.securityfocus.com/bid/64758Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029078Third Party Advisory, VDB Entry
http://archives.neohapsis.com/archives/bugtraq/2013-09/0107.htmlPatch
http://struts.apache.org/release/2.3.x/docs/s2-019.htmlPatch, Vendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.htmlThird Party Advisory
http://www.securityfocus.com/bid/64758Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029078Third Party Advisory, VDB Entry

Timeline

Published: Sep 30, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-43174.3In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the us CVE-2013-43185.4File injection vulnerability in Ruby gem Features 0.3.0 allows remote attackers to inject malicious html in the /tmp directory.CVE-2013-43199.0pbs_mom in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x, 4.x, and earlier does not properly restrict CVE-2013-43205.5The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote CVE-2013-43216.5The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary CVE-2013-43224.3Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a CVE-2013-43244.6spice-gtk 0.14, and possibly other versions, invokes the polkit authority using the insecure polkit_unix_process_new API function, which all CVE-2013-43256.9The check_permission_v1 function in base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.9 does not properly use D-Bus for com CVE-2013-43264.6RealtimeKit (aka rtkit) 0.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intend CVE-2013-43276.9systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictio CVE-2013-43296.5The xenlight library (libxl) in Xen 4.0.x through 4.2.x, when IOMMU is disabled, provides access to a busmastering-capable PCI passthrough d CVE-2013-43306.8Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple langua