The vulnerability of the implementation of the DefaultActionMapper mechanism in the Apache Struts software platform allows a perpetrator to execute arbitrary code.

🗓️ 30 Sep 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Vulnerability in Apache Struts DefaultActionMapper allows code execution from improper input handling.

Reporter	Title	Published	Views	Family All 77
zdt	Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution	26 Jul 201300:00	–	zdt
IBM Security Bulletins	Security Bulletin: IBM Call Center and Apache Struts Struts upgrade strategy (various CVEs, see below)	14 Sep 202217:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Platform Symphony (CVE-2013-2251 CVE-2013-2248 CVE-2013-2135 CVE-2013-2134 CVE-2013-2115 CVE-2013-1966 CVE-2013-1965 CVE-2013-4310)	18 Jun 201801:24	–	ibm
IBM Security Bulletins	Security Bulletin: Unauthorized access exposure on IBM SAN Volume Controller and Storwize Family (CVE-2013-2251, CVE-2013-2248 CVE-2013-2135, CVE-2013-2134, CVE-2013-2115, CVE-2013-1966 and CVE-2013-1965)	29 Mar 202301:48	–	ibm
IBM Security Bulletins	Security Bulletin:Sterling Web Channel is affected by Apache Struts 2 security vulnerabilities (CVE-2013-4310, CVE-2013-4316, CVE-2013-2251, CVE-2013-2248, CVE-2013-2135, CVE-2013-2134, CVE-2013-2115, CVE-2013-1966, CVE-2013-1965)	16 Jun 201819:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Order Management and IBM Sterling Configure, Price, Quote are affected by multiple Apache Struts 2 security vulnerabilities.	16 Jun 201819:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storwize V7000 Unified Update Includes Fixes for Multiple Vendor Security Vulnerabilities.	26 Sep 202204:23	–	ibm
IBM Security Bulletins	Security Bulletin: Unauthorized access exposure on IBM SAN Volume Controller and Storwize Family (CVE-2013-2251 CVE-2013-2248 CVE-2013-2135 CVE-2013-2134 CVE-2013-2115 CVE-2013-1966 CVE-2013-1965)	26 Sep 202222:21	–	ibm
ATTACKERKB	CVE-2013-2251	20 Jul 201300:00	–	attackerkb
Tenable Nessus	Apache Archiva 1.2.x <= 1.2.2 / 1.3.x <= 1.3.6 Multiple Vulnerabilities	29 Apr 201400:00	–	nessus

Vulners

Node

oracle webcenter_sitesMatch11.1.1.8.0

oracle oracle_flexcube_private_bankingMatch2.2.0.1

oracle oracle_flexcube_private_bankingMatch12.0.1.0

oracle webcenter_sitesMatch11.1.1.6.1

oracle oracle_flexcube_private_bankingMatch1.7

oracle oracle_flexcube_private_bankingMatch2.0

oracle oracle_flexcube_private_bankingMatch2.0.1

oracle oracle_flexcube_private_bankingMatch3.0

oracle oracle_flexcube_private_bankingMatch12.0.2

oracle mysql_enterprise_monitorRange≤2.3.14

oracle mysql_enterprise_monitorRange3.0.0–3.0.4

ibm ibm_call_center_for_commerceMatch9.5.0

ibm ibm_call_center_for_commerceMatch10.0

cisco_systems cisco_identity_services_engineRange<1.0.4.573-6

cisco_systems cisco_identity_services_engineRange1.1.0.665–1.1.0.665-4

cisco_systems cisco_identity_services_engineRange1.1.1.268–1.1.1.268-6

cisco_systems cisco_identity_services_engineRange1.1.2.145–1.1.2.145-9

cisco_systems cisco_identity_services_engineRange1.1.3.124–1.1.3.124-4

cisco_systems cisco_identity_services_engineRange1.1.4.218–1.1.4.218-4

cisco_systems cisco_identity_services_engineRange1.2.0.0–1.2.0.899

cisco_systems cisco_media_experience_engine_(mxe)_3500_seriesRange<3.3.2

apache strutsRange2.0.0–2.3.15

fujitsu interstage_business_process_manager_analyticsMatch12.0

fujitsu interstage_business_process_manager_analyticsMatch12.1

oracle siebel_apps_-_e-billingMatch6.1

oracle siebel_apps_-_e-billingMatch6.1.1

oracle siebel_apps_-_e-billingMatch6.2

Source	Link
ibm	www.ibm.com/blogs/psirt/security-bulletin-ibm-call-center-and-apache-struts-struts-upgrade-strategy-various-cves-see-below/
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/90392
seclists	www.seclists.org/fulldisclosure/2013/Oct/96
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2
cwiki	www.cwiki.apache.org/confluence/display/WW/S2-016
fujitsu	www.fujitsu.com/global/support/products/software/security/products-f/interstage-bpm-analytics-201301e.html
oracle	www.oracle.com/security-alerts/cpujan2014.html
oracle	www.oracle.com/security-alerts/cpujul2015.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2013-2251
cisa	www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv

24 Sep 2024 00:00Current

7.5High risk

Vulners AI Score7.5

CVSS 29.3

CVSS 310

EPSS0.99998