CVE-2013-2134: Arbitrary Code Execution in Apache Struts 2
Summary
CVE-2013-2134: Arbitrary code execution in Apache Struts 2. Affects org.apache.struts:struts2-core versions >= 2.0.0, < 2.3.14.3. Fixed in 2.3.14.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Struts 2 is a popular open-source framework for developing Java web applications. It provides a set of tools and libraries to simplify the development process and enhance the security of web applications. However, a vulnerability has been discovered in versions prior to 2.3.14.3 that allows remote attackers to execute arbitrary OGNL code. This vulnerability is different from CVE-2013-2135.
Vulnerability Detail
The vulnerability in Apache Struts 2 arises from improper handling of action names during wildcard matching. By sending a crafted request with a malicious action name, an attacker can exploit this vulnerability to execute arbitrary OGNL code on the target system. This can lead to remote code execution, enabling the attacker to take control of the application and potentially compromise the entire system. The severity of this vulnerability is rated as HIGH according to the Common Vulnerability Scoring System (CVSS). The vulnerability is classified under CWE-94.
How To Fix
Latest published version: 7.4.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.14.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented. The workaround involves modifying the application's configuration to disable wildcard matching for action names. This can be achieved by setting the 'struts.enable.DynamicMethodInvocation' property to 'false' in the 'struts.xml' configuration file. However, it is important to note that this workaround may impact the functionality of the application and should only be considered as a temporary measure until the upgrade can be performed.
Conclusion
The vulnerability in Apache Struts 2 allows remote code execution through the exploitation of improper handling of action names during wildcard matching. To mitigate this risk, it is crucial to upgrade to the latest version of Apache Struts 2 (2.3.14.3 or later). If immediate upgrade is not feasible, a temporary workaround can be implemented by disabling wildcard matching for action names. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.struts:struts2-core →
FAQ
Apache Struts 2 is an open-source framework for developing Java web applications. It provides a set of tools and libraries to simplify the development process and enhance the security of web applications.
This vulnerability allows remote attackers to execute arbitrary OGNL code on the target system. This can lead to remote code execution, enabling the attacker to take control of the application and potentially compromise the entire system.
To fix this vulnerability, it is recommended to upgrade Apache Struts 2 to version 2.3.14.3 or later. This version includes a fix for the vulnerability and ensures that action names are properly handled during wildcard matching.
Yes, a temporary workaround is available. It involves modifying the application's configuration to disable wildcard matching for action names by setting the 'struts.enable.DynamicMethodInvocation' property to 'false' in the 'struts.xml' configuration file.
The severity of this vulnerability is rated as HIGH according to the Common Vulnerability Scoring System (CVSS).
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts2-core.
