High severity8.1NVD Advisory· Published Jul 10, 2013· Updated Jun 16, 2026
CVE-2013-2115
CVE-2013-2115
Description
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.struts:struts2-coreMaven | >= 2.0.0, < 2.3.14.2 | 2.3.14.2 |
org.apache.struts.xwork:xwork-coreMaven | >= 2.0.0, < 2.3.14.2 | 2.3.14.2 |
Affected products
3- ghsa-coords2 versions
>= 2.0.0, < 2.3.14.2+ 1 more
- (no CPE)range: >= 2.0.0, < 2.3.14.2
- (no CPE)range: >= 2.0.0, < 2.3.14.2
Patches
Vulnerability mechanics
References
13- struts.apache.org/development/2.x/docs/s2-014.htmlnvdVendor AdvisoryWEB
- www.securityfocus.com/bid/60167nvdThird Party AdvisoryVDB Entry
- cwiki.apache.org/confluence/display/WW/S2-014nvdVendor AdvisoryWEB
- github.com/advisories/GHSA-7ghm-rpc7-p7g5ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2013-2115ghsaADVISORY
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingWEB
- cwiki.apache.org/confluence/display/WW/S2-013ghsaWEB
- github.com/apache/struts/commit/d7804297e319c7a12245e1b536e565fcea6d650ghsaWEB
- github.com/apache/struts/commit/d934c6e7430b7b98e43a0a085a2304bd31a75c3dghsaWEB
- github.com/apache/struts/commit/ea96d18d0f75c390d2595648efa3563785c272c6ghsaWEB
- github.com/apache/struts/commit/fed4f8e8a4ec69b5e7612b92d8ce3e476680474ghsaWEB
- issues.apache.org/jira/browse/WW-4063ghsaWEB
- web.archive.org/web/20140212000331/http://www.securityfocus.com/bid/60167ghsaWEB
News mentions
0No linked articles in our index yet.