CVE-2013-2134

Name: CVE-2013-2134
Creator: NVD / NIST
Published: 2013-07-16T18:55:01.38+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 70.21%

Last modified Jun 16, 2026

CVE-2013-2134 is a vulnerability of currently unknown severity. Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.. EPSS estimates a 70.21% chance of exploitation in the next 30 days.

Description

Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.

Metrics

EPSS Probability

70.21%

99.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-94

Affected Software

Vendor	Product	Versions
Apache	Struts	>= 2.0.0, < 2.3.14.3

References

http://security.gentoo.org/glsa/glsa-201409-04.xmlThird Party Advisory
http://struts.apache.org/development/2.x/docs/s2-015.htmlVendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.htmlThird Party Advisory
http://www.securityfocus.com/bid/60346Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/64758Third Party Advisory, VDB Entry
https://cwiki.apache.org/confluence/display/WW/S2-015Vendor Advisory
http://security.gentoo.org/glsa/glsa-201409-04.xmlThird Party Advisory
http://struts.apache.org/development/2.x/docs/s2-015.htmlVendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.htmlThird Party Advisory
http://www.securityfocus.com/bid/60346Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/64758Third Party Advisory, VDB Entry
https://cwiki.apache.org/confluence/display/WW/S2-015Vendor Advisory

Timeline

Published: Jul 16, 2013
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2013-2134?

How severe is CVE-2013-2134?

Severity scoring for CVE-2013-2134 is pending analysis. The EPSS model estimates a 70.21% probability of exploitation in the next 30 days.

How do I fix CVE-2013-2134?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2013-2134?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST