CVE-2013-4212

Currently unrated

Key Information:

Vendor
Apache
Status
Roller
Vendor
CVE Published:
7 December 2013

Summary

Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol, which uses a subclass of UIAction, aka "OGNL Injection."

References

http://rollerweblogger.org/project/entry/apache_roller_5_0_2
x_refsource_CONFIRM
http://www.osvdb.org/100342
vdb-entryx_refsource_OSVDB
http://www.exploit-db.com/exploits/29859
exploitx_refsource_EXPLOIT-DB

EPSS Score

93% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.