CVE-2013-2135

Publication date 16 July 2013

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.

Read the notes from the security team

Status

Package Ubuntu Release Status
libstruts1.2-java 13.04 raring
Not affected
12.10 quantal
Not affected
12.04 LTS precise
Not affected
10.04 LTS lucid
Not affected

Notes

seth-arnold

Only Struts 2 is affected