GHSA-gqqm-564f-vvxq · Severity: high · Ecosystem: maven — Arbitrary code execution in Apache Struts 2
Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.
Conclusion & alert: CVE-2013-2134 is rated High Exploit Risk (82/100): CVSS Critical severity, with high exploitation likelihood (EPSS 70.21%, 99th percentile). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| 38549 | exploit_db | edb | 2013-06-05 | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 90.94% | 70.21% | -20.72% |
| 2 | 2026-05-24 | 91.53% | 90.94% | -0.59% |
| 3 | 2026-04-08 | — | 91.53% | — |
Full EPSS history (34 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.3 | 2.0 | HIGH |
|
8.6 | 10.0 | [email protected] |
GHSA-gqqm-564f-vvxq · Severity: high · Ecosystem: maven — Arbitrary code execution in Apache Struts 2
| vendor | priority | summary | link |
|---|---|---|---|
gentoo
|
normal | CVE-2013-2134: 1 GLSA(s) (201409-04), 1 atom(s) (dev-db/mysql); latest impact normal. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2013-2134 |
ubuntu
|
medium | CVE-2013-2134 medium priority: Ubuntu including 1 source packages (libstruts1.2-java), 5 status rows across 5 suites (lucid, precise, quantal, raring, upstream): not-affected 5. | https://ubuntu.com/security/CVE-2013-2134 |
| URL | Tags |
|---|---|
| http://security.gentoo.org/glsa/glsa-201409-04.xml | Third Party Advisory |
| http://struts.apache.org/development/2.x/docs/s2-015.html | Vendor Advisory |
| http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html | Third Party Advisory |
| http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html | Third Party Advisory |
| http://www.securityfocus.com/bid/60346 | Third Party Advisory VDB Entry |
| http://www.securityfocus.com/bid/64758 | Third Party Advisory VDB Entry |
| https://cwiki.apache.org/confluence/display/WW/S2-015 | Vendor Advisory |