CVE-2013-2115: Apache Struts 2 OGNL code injection via includeParams attribute

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated remote code execution with a very high EPSS score, though not confirmed in KEV and requiring a specific tag configuration.

What it is

Apache Struts 2 before 2.3.14.2 does not properly handle the includeParams attribute in the URL or A tag, allowing remote attackers to execute arbitrary OGNL code through a crafted request. The flaw is an incomplete fix for CVE-2013-1966, so the earlier patch does not fully close the injection path. It matters because it enables unauthenticated remote code execution on a widely deployed web framework.

Impact

An attacker can execute arbitrary OGNL code in the context of the Struts application, leading to full server-side code execution and compromise of the host. This can expose data, allow persistence, and pivot into the surrounding network.

Attack surface

Reached over the network via HTTP requests to a Struts 2 application that uses the includeParams attribute in URL or A tags; the CVSS vector shows no privileges required and no user interaction. No authentication is needed per the vector.

Exploitation

Not listed in CISA KEV, but EPSS is 0.74636 (99.475th percentile), indicating a high modeled likelihood of exploitation. References are vendor advisories and issue tracking only, with no public exploit tag supplied.

What to do

• Upgrade Apache Struts 2 to 2.3.14.2 or later, which contains the complete fix for this issue.
• If immediate upgrade is not possible, remove or avoid use of the includeParams attribute in URL and A tags in application code.
• Apply input validation and block OGNL expression characters in request parameters reaching Struts tags.
• Place the application behind a WAF with rules targeting OGNL injection patterns in request parameters.
• Review for prior CVE-2013-1966 mitigations and confirm they are superseded by the 2.3.14.2 fix.

Detection

• Search web and application logs for requests containing OGNL expression syntax such as %{ or ${ in parameters tied to URL or A tags.
• Monitor for unexpected child processes or outbound connections spawned by the Java application server.
• Alert on anomalous HTTP requests to Struts action endpoints with unusual parameter names or encoded payloads.
• Audit deployed Struts versions and flag any instance below 2.3.14.2.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.