CVE-2013-2251

apache archiva, apache struts, fujitsu interstage business process manager analytics

Published 20 Jul 2013 · updated 16 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 25 Mar 2022, with a remediation deadline of 15 Apr 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

References

archiva.apache.org/security.html · Product
cxsecurity.com/issue/WLB-2014010087 · Exploit, Third Party Advisory
osvdb.org/98445 · Broken Link
packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html · Exploit, Third Party Advisory, VDB Entry
seclists.org/fulldisclosure/2013/Oct/96 · Exploit, Mailing List, Third Party Advisory
seclists.org/oss-sec/2014/q1/89 · Mailing List, Third Party Advisory
struts.apache.org/release/2.3.x/docs/s2-016.html · Patch
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2 · Third Party Advisory
www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html · Broken Link, Third Party Advisory
www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html · Patch, Third Party Advisory
www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html · Patch, Third Party Advisory
www.securityfocus.com/bid/61189 · Broken Link, Third Party Advisory, VDB Entry
www.securityfocus.com/bid/64758 · Broken Link, Third Party Advisory, VDB Entry
www.securitytracker.com/id/1029184 · Broken Link, Third Party Advisory, VDB Entry
www.securitytracker.com/id/1032916 · Broken Link, Third Party Advisory, VDB Entry
exchange.xforce.ibmcloud.com/vulnerabilities/90392 · Third Party Advisory, VDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2251 · US Government Resource