CVE-2013-2135 High Severity Vulnerability detected by WhiteSource

[mend-bolt-for-github]

CVE-2013-2135 - High Severity Vulnerability

Vulnerable Libraries - struts2-core-2.0.8.jar, struts2-core-2.0.11.jar

struts2-core-2.0.8.jar

null

path: /java_security_book/Struts2/s2_002/target/struts2-archetype-starter/WEB-INF/lib/struts2-core-2.0.8.jar,/java_security_book/Struts2/s2_001/target/struts2-archetype-starter/WEB-INF/lib/struts2-core-2.0.8.jar,2/repository/org/apache/struts/struts2-core/2.0.8/struts2-core-2.0.8.jar

Dependency Hierarchy:

• ❌ struts2-core-2.0.8.jar (Vulnerable Library)

struts2-core-2.0.11.jar

null

path: /java_security_book/Struts2/s2_005/target/struts2-archetype-starter/WEB-INF/lib/struts2-core-2.0.11.jar

Dependency Hierarchy:

• ❌ struts2-core-2.0.11.jar (Vulnerable Library)

Vulnerability Details

Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.

Publish Date: 2013-07-16

URL: CVE-2013-2135

CVSS 2 Score Details (9.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: http://struts.apache.org/development/2.x/docs/s2-015.html

Release Date: 2017-12-31

Fix Resolution: Developers should immediately upgrade to Struts 2.3.14.3

---

Step up your Open Source Security Game with WhiteSource here