CVE-2013-2251

critical-risk
Published 2013-07-20

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

Do I need to act?

!
94.3% chance of exploitation in next 30 days
EPSS score — higher than 6% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
2 public exploits available
27135, 44583
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (15)

Affected Vendors

Fujitsu Apache Oracle

References (33)

Product http://archiva.apache.org/security.html
Exploit http://cxsecurity.com/issue/WLB-2014010087
Broken Link http://osvdb.org/98445
Exploit http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Executio...
Exploit http://seclists.org/fulldisclosure/2013/Oct/96
Mailing List http://seclists.org/oss-sec/2014/q1/89
Patch http://struts.apache.org/release/2.3.x/docs/s2-016.html
Third Party Advisory http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20...
Third Party Advisory http://www.fujitsu.com/global/support/software/security/products-f/interstage-bp...
Patch http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
Patch http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
Broken Link http://www.securityfocus.com/bid/61189
Broken Link http://www.securityfocus.com/bid/64758
Broken Link http://www.securitytracker.com/id/1029184
Broken Link http://www.securitytracker.com/id/1032916
Third Party Advisory https://exchange.xforce.ibmcloud.com/vulnerabilities/90392
Product http://archiva.apache.org/security.html
Exploit http://cxsecurity.com/issue/WLB-2014010087
Broken Link http://osvdb.org/98445
Exploit http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Executio...
and 13 more references
84
/ 100
critical-risk
Severity 32/34 · Critical
Exploitability 34/34 · Critical
Exposure 18/34 · Moderate