Code Injection in Apache Struts - CVE-2013-2115
Published: April 16, 2024
Vulnerability identifier: #VU88559
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-2115
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability occurs when a crafted request is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.
Affected software
Apache Struts
SAN Volume Controller and Storwize Family
Sterling Web Channel
Call Center for Commerce
IBM Sterling Order Management
SAN Volume Controller and Storwize Family
Sterling Web Channel
Call Center for Commerce
IBM Sterling Order Management
How to mitigate CVE-2013-2115
Install updates from vendor's website.
Apache Struts - update to 2.3.14.2
SAN Volume Controller and Storwize Family - addressed in versions 6.4.1.7, 7.1.0.5
Sterling Web Channel - addressed in versions 9.0.0-SFP1, 9.1.0- SFP1
Call Center for Commerce - update to 10.0.12
IBM Sterling Order Management - update to 10.0.2403.1
SAN Volume Controller and Storwize Family - addressed in versions 6.4.1.7, 7.1.0.5
Sterling Web Channel - addressed in versions 9.0.0-SFP1, 9.1.0- SFP1
Call Center for Commerce - update to 10.0.12
IBM Sterling Order Management - update to 10.0.2403.1