CVE-2013-1965 Apache Struts
| Affected software | Apache Struts |
|---|---|
| Severity | 9.3 High CVSS 2.0 |
| Fixed in | 2.3.14.3 |
| Weakness | Code injection (CWE-94) |
| Published | 10 Jul 2013 |
| Updated | 13 Nov 2026 |
Description
Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.
Exploitation status
Exploited
Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV listed Exploitation reported in the wild. Honeypot sightings · 1 exploit · earliest 2026-11-08.
- CISA Vulnrichment no assessment published
- Indexed PoC 2 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2015-06-04.
- EPSS 94% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.8% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2013-1965 in VulnCheck (free account).
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | VulnCheck canaries | Exploitation attempts seen on 5 days | 2026-11-08 to 2026-11-12 |
| Exploit reference | VulnCheck XDB c9b701c72a52 | Exploit type: remote-with-credentials | 2015-06-04 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | A proof of concept exploit for the CVE-2013-1965 vulnerability affecting Apache Struts 2 | 1 | 2015-06-04 |
| Nuclei | Apache Struts2 S2-012 RCE |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Process
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the ARMR Process rule. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: ARMR Process rule
Exploitation forks a process. Blocked by the Process rule in PROTECT mode.
Only stops attacks that start a program; an expression that reads files or data directly in Java is not stopped.
How to mitigate CVE-2013-1965
Upgrade Apache Struts to 2.3.14.3 or later. Until you can, Waratek RASP blocks exploitation with its process rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.struts:struts2-core |
0 | 2.3.14.3 |
unbounded |
Products and versions
3 products, 3 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | struts | generic | ≥ 2.0.0 and ＜ 2.3.14.1 |
| nvd | apache | struts2-showcase | generic | ≥ 2.0.0 and ≤ 2.3.13 |
| osv | org.apache.struts | struts2-core | generic | ＜ 2.3.14.3 |
References
Timeline
Timeline
| Published | 2013-07-10 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-16 | NVD's own last-modified date for this record. |
| VulnCheck KEV: earliest evidence | 2026-11-08 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| VulnCheck KEV: latest evidence | 2026-11-12 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |
| Last VRT activity | 2026-11-13 | Most recent commit touching this CVE's classification, patch or rule file. |