How severe is CVE-2013-4212?

CVE-2013-4212 has a CVSS 2.0 base score of 6.8, rated medium severity.

Is CVE-2013-4212 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 81% (100th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2013-4212?

CVE-2013-4212 primarily affects Apache Roller. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2013-4212?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2013-4212 published?

CVE-2013-4212 was published on 2013-12-07 and last updated on 2026-06-16.

CVE-2013-4212

CVE-2013-4212 is a medium-severity vulnerability in Apache Roller with a CVSS 2.0 base score of 6.8. Its EPSS exploit-prediction score of 81% places it in the 100th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-94.

Key facts

Severity: Medium (CVSS 2.0 base score 6.8)
EPSS exploit prediction: 81% (100th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-94
Affected product: Apache Roller
Published: 2013-12-07
Last modified: 2026-06-16

Description

Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol, which uses a subclass of UIAction, aka "OGNL Injection."

Frequently asked questions

What is CVE-2013-4212?: Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol, which uses a subclass of UIAction, aka "OGNL Injection."
How severe is CVE-2013-4212?: CVE-2013-4212 has a CVSS 2.0 base score of 6.8, rated medium severity.
Is CVE-2013-4212 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 81% (100th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2013-4212?: CVE-2013-4212 primarily affects Apache Roller. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2013-4212?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2013-4212 published?: CVE-2013-4212 was published on 2013-12-07 and last updated on 2026-06-16.

References

Affected products (4)

cpe:2.3:a:apache:roller:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:roller:4.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:roller:4.0.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:roller:5.0:*:*:*:*:*:*:*

More vulnerabilities in Apache Roller

CVE-2018-17198 — Critical (CVSS 9.8): Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier…
CVE-2014-0030 — Critical (CVSS 9.8): The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE)…
CVE-2025-24859 — High (CVSS 8.8): A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not…
CVE-2021-33580 — High (CVSS 7.5): User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to…
CVE-2015-0249 — High (CVSS 7.2): The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for…
CVE-2012-2380 — Medium (CVSS 6.8): Multiple cross-site request forgery (CSRF) vulnerabilities in the admin/editor console in Apache Roller before 5.0.1…

All CVEs affecting Apache Roller →

Other CWE-94 (Code Injection) vulnerabilities

CVE-2026-57624 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.
CVE-2026-10134 — Critical (CVSS 10.0): IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read…
CVE-2026-53576 — Critical (CVSS 10.0): Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter…
CVE-2026-10561 — Critical (CVSS 10.0): IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined…
CVE-2026-25470 — Critical (CVSS 10.0): Improper Control of Generation of Code ('Code Injection') vulnerability in ACPT ACPT (Pro) - Custom Post Types Plugin…
CVE-2026-48836 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.

Browse all CWE-94 (Code Injection) vulnerabilities →