CVE-2013-2251
CRITICAL9.8⚠ KEVEPSS 94.3%Code injection in Apache Struts
Published: 5/13/2022Modified: 10/22/2025Added to CISA KEV: 3/25/2022
Description
The Struts 2 DefaultActionMapper supports a method for short-circuit navigation state changes by prefixing parameters with "action:" or "redirect:", followed by a desired navigational target expression. This mechanism was intended to help with attaching navigational information to buttons within forms. In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
Affected packages (1)
- Maven/org.apache.struts:struts2-corefrom 0, < 2.3.15.1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H |
References (17)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2013-2251
- PATCHhttps://github.com/apache/struts
- WEBhttp://archiva.apache.org/security.html
- WEBhttp://cxsecurity.com/issue/WLB-2014010087
- WEBhttp://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html
- WEBhttp://seclists.org/fulldisclosure/2013/Oct/96
- WEBhttp://seclists.org/oss-sec/2014/q1/89
- WEBhttps://exchange.xforce.ibmcloud.com/vulnerabilities/90392
- WEBhttps://github.com/apache/struts/commit/3cfe34fefedcf0fdcfcb061c0aea34a715b7de6
- WEBhttps://github.com/apache/struts/commit/630e1ba065a8215c4e9ac03bfb09be9d655c2b6e
- WEBhttps://issues.apache.org/jira/browse/WW-4140
- WEBhttp://struts.apache.org/release/2.3.x/docs/s2-016.html
- WEBhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2251
- WEBhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2
- WEBhttp://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html
- WEBhttp://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- WEBhttp://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html