Apache Struts Dynamic Method Execution Vulnerability

• Email
• Facebook
• 
  Twitter
• Google+
• Linkedin

  Severity: CRITICAL

  CVE Identifier: CVE-2013-4316

  Advisory Date: JUL 21, 2015

---

  DESCRIPTION

Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.

  TREND MICRO PROTECTION INFORMATION

Apply associated Trend Micro DPI Rules.

  SOLUTION

  Trend Micro Deep Security DPI Rule Number: 1005692

  Trend Micro Deep Security DPI Rule Name: 1005692 - Identified Apache Struts Dynamic Method Invocation In HTTP Request

  AFFECTED SOFTWARE AND VERSION

• apache struts 2.0.0
• apache struts 2.0.1
• apache struts 2.0.10
• apache struts 2.0.11
• apache struts 2.0.11.1
• apache struts 2.0.11.2
• apache struts 2.0.12
• apache struts 2.0.13
• apache struts 2.0.14
• apache struts 2.0.2
• apache struts 2.0.3
• apache struts 2.0.4
• apache struts 2.0.5
• apache struts 2.0.6
• apache struts 2.0.7
• apache struts 2.0.8
• apache struts 2.0.9
• apache struts 2.1.0
• apache struts 2.1.1
• apache struts 2.1.2
• apache struts 2.1.3
• apache struts 2.1.4
• apache struts 2.1.5
• apache struts 2.1.6
• apache struts 2.1.8
• apache struts 2.1.8.1
• apache struts 2.2.1
• apache struts 2.2.1.1
• apache struts 2.2.3
• apache struts 2.2.3.1
• apache struts 2.3.1
• apache struts 2.3.1.1
• apache struts 2.3.1.2
• apache struts 2.3.12
• apache struts 2.3.14
• apache struts 2.3.14.1
• apache struts 2.3.14.2
• apache struts 2.3.14.3
• apache struts 2.3.15
• apache struts 2.3.15.1
• apache struts 2.3.3
• apache struts 2.3.4
• apache struts 2.3.4.1
• apache struts 2.3.7
• apache struts 2.3.8