CVE-2013-1965: Apache Struts OGNL code injection via crafted redirect parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS 2.0 score of 9.3 and an EPSS probability above 0.93 makes this an urgent patch target despite the absence of KEV listing.

What it is

Apache Struts 2 before 2.3.14.3, including the Struts Showcase App 2.0.0 through 2.3.13, fails to properly handle a crafted parameter name when invoking a redirect, allowing remote OGNL code injection. Because OGNL can reach Java runtime internals, this is a full remote code execution flaw rather than a simple input validation bug.

Impact

An unauthenticated remote attacker can execute arbitrary OGNL code in the context of the application server, leading to full compromise of confidentiality, integrity and availability.

Attack surface

Reachable over the network via HTTP requests to a vulnerable Struts 2 application, specifically through a crafted parameter name processed during a redirect; the CVSS vector indicates no authentication is required and no user interaction is needed.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high at 0.935 (99.8th percentile), and the vendor advisory S2-012 plus third-party references describe the flaw publicly, so exploitation should be assumed feasible.

What to do

• Upgrade Apache Struts 2 to 2.3.14.3 or later, which is the version that fixes this issue.
• If immediate upgrade is not possible, remove or disable the Struts Showcase App and any unused sample applications from production.
• Apply input validation or a WAF rule that blocks suspicious OGNL expressions in request parameter names, especially on redirect-handling endpoints.
• Restrict outbound and server-side network access from the application server to limit post-exploitation movement.
• Review application logs for redirect requests with unusual parameter names and treat any hits as potential compromise.

Detection

• Search web access logs for requests containing OGNL metacharacters such as %{ or # in parameter names, particularly on redirect endpoints.
• Monitor for unexpected child processes or command execution spawned by the Java application server process.
• Alert on outbound network connections from the application server to unfamiliar hosts, which may indicate post-exploitation activity.
• Audit deployed Struts 2 versions and flag any instance below 2.3.14.3.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.