Skip to content
OpenAdvisories
High CVE-2013-4316 EUVD-2022-4305GHSA-j7h6-xr7g-m2c5

Code injection in Apache Struts

Published Sep 30, 2013 · Updated Aug 6, 2024 · Assigned by redhat

Package: org.apache.struts:struts2-core Package: org.apache.struts:struts2-rest-plugin Ecosystem: Maven

Description

Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.struts:struts2-core >= 2.0.0, < 2.3.15.2 2.3.15.2 GHSA-j7h6-xr7g-m2c5
Maven org.apache.struts:struts2-rest-plugin >= 2.0.0, < 2.3.15.2 2.3.15.2 GHSA-j7h6-xr7g-m2c5

References