CVE-2014-0113: apache struts

EPSS trend

Probability

78.32%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

+0.49 pp

From 77.83% on 18-09-2026

18-09-202618-10-2026

EPSS score

78.32%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

exploit-databaseremotemultipleVerified
Apache Struts - ClassLoader Manipulation Remote Code Execution (Metasploit)
Maturity: weaponized

References

7 links

cwiki.apache.org/confluence/display/WW/S2-021X Refsource CONFIRMPatchVendor AdvisoryWEB
secunia.com/advisories/59178Third Party AdvisoryX Refsource SECUNIAPermissions Required
www.securityfocus.com/archive/1/531952/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.htmlX Refsource CONFIRMThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21676706X Refsource CONFIRMThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2014-0113Advisory
github.com/apache/strutsPACKAGE

Related vulnerabilities

CVE-2018-1327apache software foundationapache struts+28.65%8y ago27-03-2018 21:00The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.CVE-2018-11776apache software foundationapache struts+9KEV99.99%8y ago22-08-2018 13:00Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.CVE-2013-2134apachestruts+270.21%13y ago16-07-2013 18:00Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.CVE-2013-2115apachestruts+274.64%13y ago10-07-2013 19:00Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.CVE-2013-2251apachearchiva+4KEV100.00%13y ago18-07-2013 01:00Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.CVE-2013-2135apachestruts+213.83%13y ago16-07-2013 18:00Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.

All vulnerabilities instruts

CVE-2014-0113: apache struts

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References