VulnerabilityAnalyzed

CVE-2013-2251

Apache Struts Improper Input Validation Vulnerability

KEVEXPLOIT ×2 ✓CRITICAL 9.8EPSS 100.0%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 15 April 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 100.00% probability · 100th percentile
Public exploits: 2 in Exploit-DB · verified · first 27 July 2013
CISA KEV: Listed 25 March 2022 · due 15 April 2022
Weakness: CWE-74
Affected: apache/archiva · apache/struts · fujitsu/interstage business process manager analytics · oracle/siebel apps - e-billing
Source: secalert@redhat.com

EPSS trend

EPSS 100.0% since 30 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

CISA notes

Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2013-2251

Public exploits (2)

Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.

EDB-ID	Title	Type	Published	Verified
EDB-44583 source ↗	Apache Struts2 2.0.0 < 2.3.15 - Prefixed Parameters OGNL Injectionmultiple · Takeshi Terada	webapps	14 January 2014	yes
EDB-27135 source ↗	Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution (Metasploit)multiple · Metasploit	remote	27 July 2013	yes

References

http://archiva.apache.org/security.htmlProduct
http://cxsecurity.com/issue/WLB-2014010087Exploit, Third Party Advisory
http://osvdb.org/98445Broken Link
http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2013/Oct/96Exploit, Mailing List, Third Party Advisory
http://seclists.org/oss-sec/2014/q1/89Mailing List, Third Party Advisory
http://struts.apache.org/release/2.3.x/docs/s2-016.htmlPatch
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2Third Party Advisory
http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.htmlBroken Link, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlPatch, Third Party Advisory
http://www.securityfocus.com/bid/61189Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/64758Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029184Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032916Broken Link, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/90392Third Party Advisory, VDB Entry
http://archiva.apache.org/security.htmlProduct
http://cxsecurity.com/issue/WLB-2014010087Exploit, Third Party Advisory
http://osvdb.org/98445Broken Link
http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2013/Oct/96Exploit, Mailing List, Third Party Advisory
http://seclists.org/oss-sec/2014/q1/89Mailing List, Third Party Advisory
http://struts.apache.org/release/2.3.x/docs/s2-016.htmlPatch
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2Third Party Advisory
http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.htmlBroken Link, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlPatch, Third Party Advisory
http://www.securityfocus.com/bid/61189Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/64758Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029184Broken Link, Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.