critical10.0
CVE-2013-4316
Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.
Impact
Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Struts | Versions 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5 |
| Oracle | Flexcube Private Banking | Versions 1.7, 2.0, 2.0.1, 2.2.0.1, 3.0, 12.0.1 |
| Oracle | Mysql Enterprise Monitor | through 2.3.14 through 3.0.4 |
| Oracle | Webcenter Sites | Versions 11.1.1.6.1, 11.1.1.8.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://archives.neohapsis.com/archives/bugtraq/2013-09/0107.html
- http://struts.apache.org/release/2.3.x/docs/s2-019.html
- http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- http://www.securityfocus.com/bid/64758
- http://www.securitytracker.com/id/1029078
- http://archives.neohapsis.com/archives/bugtraq/2013-09/0107.html
- http://struts.apache.org/release/2.3.x/docs/s2-019.html
- http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- http://www.securityfocus.com/bid/64758
- http://www.securitytracker.com/id/1029078