Apache Struts 'includeParams' CVE-2013-2115 Incomplete Fix Security Bypass Vulnerability

Bugtraq ID:	60167
Class:	Design Error
CVE:	CVE-2013-2115
Remote:	Yes
Local:	No
Published:	May 27 2013 12:00AM
Updated:	Jun 02 2014 12:20AM
Credit:	Eric Kobrin and Douglas Rodrigues (Akamai), Coverity Security Research Laboratory, NSFOCUS Security Team
Vulnerable:	IBM Storwize V7000 Unified 1.3.1.0 IBM Storwize V7000 Unified 1.3.0.5 IBM Storwize V7000 Unified 1.3.0.0 Apache Software Foundation Struts 2.2.3 Apache Software Foundation Struts 2.2.1 1 Apache Software Foundation Struts 2.2 Apache Software Foundation Struts 2.3.1.2 Apache Software Foundation Struts 2.3.1.1 Apache Software Foundation Struts 2.2.3.1
Not Vulnerable:

Apache Struts 'includeParams' CVE-2013-2115 Incomplete Fix Security Bypass Vulnerability

Apache Struts is prone to a security-bypass vulnerability because it fails to adequately handle user-supplied input.

Attackers can exploit this issue to manipulate server-side context objects with the privileges of the user running the application. Successful exploits can compromise the application and possibly the underlying computer.

Apache Struts versions 2.0.0 through 2.3.14.1 are vulnerable.

Note: This issue is the result of an incomplete fix for the issue described in BID 60166 (Apache Struts 'includeParams' CVE-2013-1966 Security Bypass Vulnerability).

Apache Struts 'includeParams' CVE-2013-2115 Incomplete Fix Security Bypass Vulnerability

Attackers can use readily available tools to exploit this issue.

The following exploit is available:

• /data/vulnerabilities/exploits/60167.rb

Apache Struts 'includeParams' CVE-2013-2115 Incomplete Fix Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apache Struts 'includeParams' CVE-2013-2115 Incomplete Fix Security Bypass Vulnerability

References:

• Struts Homepage (Apache Software Foundation)