CVE-2013-4316 High Severity Vulnerability detected by WhiteSource

[mend-bolt-for-github]

CVE-2013-4316 - High Severity Vulnerability

Vulnerable Libraries - struts2-core-2.0.8.jar, struts2-core-2.0.11.jar

struts2-core-2.0.8.jar

null

path: /java_security_book/Struts2/s2_002/target/struts2-archetype-starter/WEB-INF/lib/struts2-core-2.0.8.jar,/java_security_book/Struts2/s2_001/target/struts2-archetype-starter/WEB-INF/lib/struts2-core-2.0.8.jar,2/repository/org/apache/struts/struts2-core/2.0.8/struts2-core-2.0.8.jar

Dependency Hierarchy:

• ❌ struts2-core-2.0.8.jar (Vulnerable Library)

struts2-core-2.0.11.jar

null

path: /java_security_book/Struts2/s2_005/target/struts2-archetype-starter/WEB-INF/lib/struts2-core-2.0.11.jar

Dependency Hierarchy:

• ❌ struts2-core-2.0.11.jar (Vulnerable Library)

Vulnerability Details

Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.

Publish Date: 2013-09-30

URL: CVE-2013-4316

CVSS 2 Score Details (10.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: http://struts.apache.org/release/2.3.x/docs/s2-019.html

Release Date: 2017-12-31

Fix Resolution: Developers should immediately upgrade to Struts 2.3.15.2

---

Step up your Open Source Security Game with WhiteSource here