CVE-2013-4316: Apache Struts

High severity, CVSS 10.0. EPSS: 8.4% chance of exploitation in the next 30 days.

Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.

Affected products

• Apache Struts: version 2.0.0 only; version 2.0.1 only; version 2.0.2 only; version 2.0.3 only; version 2.0.4 only; version 2.0.5 only; …
• Oracle Flexcube Private Banking: version 1.7 only; version 2.0 only; version 2.0.1 only; version 2.2.0.1 only; version 3.0 only; version 12.0.1 only; …
• Oracle MySQL Enterprise Monitor: up to and including 2.3.14; up to and including 3.0.4
• Oracle Webcenter Sites: version 11.1.1.6.1 only; version 11.1.1.8.0 only

Published 2013-09-30. Last modified 2026-06-16.