CVE-2013-1966
Published: 10 July 2013
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.
Notes
| Author | Note |
|---|---|
| jdstrand | per Debian, only affects Struts 2 |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
libstruts1.2-java Launchpad, Ubuntu, Debian |
lucid |
Not vulnerable
|
| precise |
Not vulnerable
|
|
| quantal |
Not vulnerable
|
|
| raring |
Not vulnerable
|
|
| upstream |
Needs triage
|