CVE-2013-4316
Code injection in Apache Struts
10.0 HighFix available
CVE-2013-4316 is a high vulnerability (CVSS 10.0) in Apache Struts, published September 30, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.40%, the 95th percentile. Fixed in org.apache.struts:struts2-core 2.3.15.2.
- Severity
- 10.0 HighCVSS 2.0, NVD
- Exploit chance
- 8.40%EPSS, 95th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.3.15.2org.apache.struts:struts2-core +3 more
Description
Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.
Exploit likelihood
8.40%Up 6.5 points since Feb 4, 2022
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts:struts2-coreMaven | 2.0.0 up to 2.3.15.2 | 2.3.15.2 |
org.apache.struts:struts2-rest-pluginMaven | 2.0.0 up to 2.3.15.2 | 2.3.15.2 |
org.apache.struts:struts2-coreMaven | 2.0.0 up to 2.3.15.2, plus listed versions 2.0.112.0.11.12.0.11.22.0.122.0.14 Show 27 moreShow less2.0.52.0.62.0.82.0.92.1.22.1.62.1.82.1.8.12.2.12.2.1.12.2.32.2.3.12.3.12.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.32.3.42.3.4.12.3.72.3.8 | 2.3.15.2 |
org.apache.struts:struts2-rest-pluginMaven | 2.0.0 up to 2.3.15.2, plus listed versions 2.1.22.1.62.1.82.1.8.12.2.1 Show 18 moreShow less2.2.1.12.2.32.2.3.12.3.12.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.32.3.42.3.4.12.3.72.3.8 | 2.3.15.2 |
What each source reports
NVD Score used
Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.
- Record
CVE-2013-4316- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-16, CWE-284
- Updated
- 2026-11-02
CVE ListNo score
Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.
- Record
CVE-2013-4316- Updated
- 2026-11-02
EUVDEUVD-2022-4305No score
Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.
- Record
EUVD-2022-4305- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j7h6-xr7g-m2c5No score
Code injection in Apache Struts
Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.
- Record
GHSA-j7h6-xr7g-m2c5- Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-j7h6-xr7g-m2c5No score
Code injection in Apache Struts
Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.
- Record
GHSA-j7h6-xr7g-m2c5- Weakness
- CWE-94
- Updated
- 2026-11-02
OSVSUSE-SU-2015:0620-1No score
Security update for MySQL
This MySQL update provides the following:
* upgrade to version 5.5.39, [bnc#887580]
* CVE's fixed: CVE-2014-2484, CVE-2014-4258, CVE-2014-4260,
CVE-2014-2494, CVE-2014-4238, CVE-2014-4207, CVE-2014-4233,
CVE-2014-4240, CVE-2014-4214, CVE-2014-4243
See also: http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
Security Issues:
* CVE-2014-2484
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2484>
* CVE-2014-4258
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4258>
* CVE-2014-4260
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4260>
* CVE-2014-2494
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2494>
* CVE-2014-4238
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4238>
* CVE-2014-4207
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4207>
* CVE-2014-4233
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4233>
* CVE-2014-4240
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4240>
* CVE-2014-4214
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4214>
* CVE-2014-4243
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4243>
- Record
SUSE-SU-2015:0620-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0946-1No score
Security update for MySQL
This MySQL update provides the following:
* upgrade to version 5.5.39, [bnc#887580]
* CVE's fixed: CVE-2014-2484, CVE-2014-4258, CVE-2014-4260,
CVE-2014-2494, CVE-2014-4238, CVE-2014-4207, CVE-2014-4233,
CVE-2014-4240, CVE-2014-4214, CVE-2014-4243
See also: http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
Security Issues:
* CVE-2014-2484
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2484>
* CVE-2014-4258
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4258>
* CVE-2014-4260
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4260>
* CVE-2014-2494
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2494>
* CVE-2014-4238
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4238>
* CVE-2014-4207
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4207>
* CVE-2014-4233
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4233>
* CVE-2014-4240
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4240>
* CVE-2014-4214
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4214>
* CVE-2014-4243
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4243>
- Record
SUSE-SU-2015:0946-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1177-1No score
Security update for MySQL
This MySQL update provides the following:
* upgrade to version 5.5.39, [bnc#887580]
* CVE's fixed: CVE-2014-2484, CVE-2014-4258, CVE-2014-4260,
CVE-2014-2494, CVE-2014-4238, CVE-2014-4207, CVE-2014-4233,
CVE-2014-4240, CVE-2014-4214, CVE-2014-4243
See also: http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
Security Issues:
* CVE-2014-2484
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2484>
* CVE-2014-4258
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4258>
* CVE-2014-4260
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4260>
* CVE-2014-2494
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2494>
* CVE-2014-4238
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4238>
* CVE-2014-4207
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4207>
* CVE-2014-4233
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4233>
* CVE-2014-4240
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4240>
* CVE-2014-4214
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4214>
* CVE-2014-4243
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4243>
- Record
SUSE-SU-2015:1177-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
archives.neohapsis.com/archives/bugtraq/2013-09/0107.html
struts.apache.org/release/2.3.x/docs/s2-019.html
securityfocus.com/bid/64758
oracle.com/technetwork/topics/security/cpujan2014-1972949.html
securitytracker.com/id/1029078
nvd.nist.gov/vuln/detail/CVE-2013-4316
Show 156 moreShow less
github.com/apache/struts/commit/58947c3f85ae641c1a476316a2888e53605948d1
suse.com/support/update/announcement/2015/suse-su-20150620-1
bugzilla.suse.com/734436