CVE-2013-4316

Опубликовано: 30 сент. 2013

Источник: nvd

CVSS2: 10

EPSS Низкий

Описание

Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.

Ссылки

http://archives.neohapsis.com/archives/bugtraq/2013-09/0107.html
Patch
http://struts.apache.org/release/2.3.x/docs/s2-019.html
Patch
Vendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
Third Party Advisory
http://www.securityfocus.com/bid/64758
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1029078
Third Party Advisory
VDB Entry
http://archives.neohapsis.com/archives/bugtraq/2013-09/0107.html
Patch
http://struts.apache.org/release/2.3.x/docs/s2-019.html
Patch
Vendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
Third Party Advisory
http://www.securityfocus.com/bid/64758
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1029078
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:*

cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:a:oracle:flexcube_private_banking:1.7:*:*:*:*:*:*:*

cpe:2.3:a:oracle:flexcube_private_banking:2.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:flexcube_private_banking:2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:flexcube_private_banking:2.2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:flexcube_private_banking:3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:flexcube_private_banking:12.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:flexcube_private_banking:12.0.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*

Версия до 2.3.14 (включая)

cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*

Версия до 3.0.4 (включая)

cpe:2.3:a:oracle:webcenter_sites:11.1.1.6.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:webcenter_sites:11.1.1.8.0:*:*:*:*:*:*:*

EPSS

Процентиль: 94%

0.08333

Низкий

10 Critical

CVSS2

Дефекты

CWE-16

Связанные уязвимости

CVE-2013-4316

ubuntu

почти 13 лет назад

Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.

CVE-2013-4316

redhat

почти 13 лет назад

Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.

CVE-2013-4316

debian

почти 13 лет назад

Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation ...

GHSA-j7h6-xr7g-m2c5

github

около 4 лет назад

Code injection in Apache Struts

BDU:2022-06073

CVSS3: 9.8

fstec

почти 13 лет назад

Уязвимость реализации механизма Dynamic Method Invocation (DMI) программной платформы Apache Struts, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 94%

0.08333

Низкий

10 Critical

CVSS2

Дефекты

CWE-16