CVEvulnerability
CVE-2013-4212
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2013-12-07
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-94
Description
Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol, which uses a subclass of UIAction, aka "OGNL Injection."
Affected configurations
• apache roller (<= 5.0.1)
• apache roller 4.0
• apache roller 4.0.1
• apache roller 5.0
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- http://rollerweblogger.org/project/entry/apache_roller_5_0_2 Patch
- http://secunia.com/advisories/55862 Vendor Advisory
- http://secunia.com/advisories/55877 Vendor Advisory
- http://security.coverity.com/advisory/2013/Oct/remote-code-execution-in-apache-roller-via-ognl-injection.html security.coverity.com
- http://www.exploit-db.com/exploits/29859 Exploit
- http://www.osvdb.org/100342 www.osvdb.org
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89239 exchange.xforce.ibmcloud.com
- http://rollerweblogger.org/project/entry/apache_roller_5_0_2 Patch
- http://secunia.com/advisories/55862 Vendor Advisory
- http://secunia.com/advisories/55877 Vendor Advisory
- http://security.coverity.com/advisory/2013/Oct/remote-code-execution-in-apache-roller-via-ognl-injection.html security.coverity.com
- http://www.exploit-db.com/exploits/29859 Exploit
- http://www.osvdb.org/100342 www.osvdb.org
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89239 exchange.xforce.ibmcloud.com