CVE-2013-1965: Apache Struts Showcase App Remote Code Execution
Summary
CVE-2013-1965: Improper Control of Generation of Code in Apache Struts. Affects org.apache.struts:struts2-core versions < 2.3.14.3. Fixed in 2.3.14.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and a MVC (Model-View-Controller) architecture. The Showcase App is a sample application included in Apache Struts, demonstrating various features and functionalities. It is vulnerable to a remote code execution vulnerability.
Vulnerability Detail
The Apache Struts Showcase App version 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, is affected by an improper control of code generation vulnerability. This vulnerability allows remote attackers to execute arbitrary OGNL (Object-Graph Navigation Language) code by exploiting a flaw in the handling of crafted parameter names during a redirect. By manipulating the parameter name, an attacker can inject malicious code that will be executed on the server, potentially leading to unauthorized access, data leakage, or other malicious activities.
How To Fix
Latest published version: 7.4.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.14.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the Showcase App or any other vulnerable functionality in your Apache Struts application. This can be achieved by removing or disabling the corresponding entry points or configurations that expose the vulnerable code. However, this is only a temporary solution, and it is strongly recommended to apply the official fix by upgrading to a non-vulnerable version as soon as possible.
Conclusion
The Apache Struts Showcase App is vulnerable to remote code execution due to an improper control of code generation issue. It is crucial to upgrade to a non-vulnerable version of Apache Struts to mitigate this vulnerability. If immediate upgrade is not possible, disabling the vulnerable functionality can serve as a temporary workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.struts:struts2-core →
FAQ
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and follows the MVC (Model-View-Controller) architecture.
The Showcase App is a sample application included in Apache Struts, demonstrating various features and functionalities of the framework.
OGNL (Object-Graph Navigation Language) is an expression language used in Apache Struts for accessing and manipulating object properties.
Exploiting this vulnerability can lead to remote code execution, allowing attackers to execute arbitrary code on the server. This can result in unauthorized access, data leakage, or other malicious activities.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts2-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
