Configuration in Apache Struts - CVE-2013-4316

Vulnerability identifier: #VU82186

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2013-4316

CWE-ID: CWE-16

Exploitation vector: Remote access

Exploit availability: No public exploit available

The issue may allow a remote attacker to bypass implemented security restrictions.

The issue exists due to Apache Struts enables Dynamic Method Invocation by default. A remote attacker can trigger the vulnerability to bypass implemented security restrictions.

Apache Struts
SAN Volume Controller and Storwize Family
Sterling Web Channel
Call Center for Commerce
IBM Sterling Order Management

Install updates from vendor's website.

SAN Volume Controller and Storwize Family - addressed in versions 6.4.1.7, 7.1.0.6
Sterling Web Channel - addressed in versions 9.0.0-SFP1, 9.1.0- SFP1
Call Center for Commerce - update to 10.0.12
IBM Sterling Order Management - update to 10.0.2403.1

• http://archives.neohapsis.com/archives/bugtraq/2013-09/0107.html
• http://struts.apache.org/release/2.3.x/docs/s2-019.html
• http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
• http://www.securityfocus.com/bid/64758
• http://www.securitytracker.com/id/1029078

• Multiple vulnerabilities in IBM SAN Volume Controller and Storwize Family
• Multiple vulnerabilities in IBM Sterling Order Management
• Multiple vulnerabilities in IBM Call Center for Commerce
• Multiple vulnerabilities in IBM Sterling Web Channel