CVE-2013-2251criticalunder attackCWE-74

CVE-2013-2251

Published · Updated

Follow this CVE+ Monitor Apache Struts+ Monitor org.apache.struts:struts2-core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon9 days
Published on NVDJul 18
1st PoC+9d
metasploitJul 2
CISA KEV+3172d
Action required by CISAfederal deadline: 2022-04-15

Apply updates per vendor instructions.

In short

Apache Struts 2 versions up to 2.3.15 allow attackers to run malicious code on the server by sending specially crafted requests. This happens because the application doesn't properly validate user input before processing it, putting any website using this software at serious risk.

Technical detail

Remote attackers can achieve arbitrary code execution by injecting malicious OGNL (Object-Graph Navigation Language) expressions through HTTP parameters with action:, redirect:, or redirectAction: prefixes. The vulnerability exists due to insufficient input validation in parameter processing, allowing unauthenticated exploitation with critical impact on confidentiality, integrity, and availability.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.