How severe is CVE-2013-4212?

CVE-2013-4212 has a CVSS 2.0 base score of 6.8, rated medium severity.

Is CVE-2013-4212 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 81% (100th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2013-4212?

CVE-2013-4212 primarily affects Apache Roller. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2013-4212?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2013-4212 published?

CVE-2013-4212 was published on 2013-12-07 and last updated on 2026-06-16.

CVE-2013-4212

CVE-2013-4212 is a medium-severity vulnerability in Apache Roller with a CVSS 2.0 base score of 6.8. Its EPSS exploit-prediction score of 81% places it in the 100th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-94.

Key facts

Severity: Medium (CVSS 2.0 base score 6.8)
EPSS exploit prediction: 81% (100th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-94
Affected product: Apache Roller
Published: 2013-12-07
Last modified: 2026-06-16

Description

Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol, which uses a subclass of UIAction, aka "OGNL Injection."

Frequently asked questions

What is CVE-2013-4212?: Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol, which uses a subclass of UIAction, aka "OGNL Injection."
How severe is CVE-2013-4212?: CVE-2013-4212 has a CVSS 2.0 base score of 6.8, rated medium severity.
Is CVE-2013-4212 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 81% (100th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2013-4212?: CVE-2013-4212 primarily affects Apache Roller. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2013-4212?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2013-4212 published?: CVE-2013-4212 was published on 2013-12-07 and last updated on 2026-06-16.

References

Affected products (4)

cpe:2.3:a:apache:roller:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:roller:4.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:roller:4.0.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:roller:5.0:*:*:*:*:*:*:*

More vulnerabilities in Apache Roller

CVE-2018-17198 — Critical (CVSS 9.8): Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier…
CVE-2014-0030 — Critical (CVSS 9.8): The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE)…
CVE-2025-24859 — High (CVSS 8.8): A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not…
CVE-2021-33580 — High (CVSS 7.5): User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to…
CVE-2015-0249 — High (CVSS 7.2): The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for…
CVE-2012-2380 — Medium (CVSS 6.8): Multiple cross-site request forgery (CSRF) vulnerabilities in the admin/editor console in Apache Roller before 5.0.1…

All CVEs affecting Apache Roller →

Other CWE-94 (Code Injection) vulnerabilities

CVE-2026-76605 — Critical (CVSS 10.0): Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.3 - ???.
CVE-2026-76604 — Critical (CVSS 10.0): Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.3 - The…
CVE-2026-67364 — Critical (CVSS 10.0): Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1:…
CVE-2026-73343 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.
CVE-2026-74253 — Critical (CVSS 10.0): Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 14.0.0…
CVE-2026-73678 — Critical (CVSS 10.0): MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that…

Browse all CWE-94 (Code Injection) vulnerabilities →