CveMateVulnerability intelligence

CVE-2013-2251: Apache Struts Improper Input Validation Vulnerability

CVSS: 9.8v3.1CriticalKEVAnalyzed

AliasesGHSA-47qp-8v9g-39hp

Published 18-07-2013Last modified 22-10-2025

Vulnerability summary

CVE-2013-2251 is a critical (CVSS 9.8) Injection vulnerability in Apache Struts. It is known to be exploited: CISA lists it, first on 25-03-2022. EPSS estimates a 100.00% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 6 public exploits are recorded.

Overall risk

85/100

0100

Critical · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.1 (CVE.org)

EPSS score

100.00%

0%100%

Critical · 0.00 pp in 30 days

KEVListedCISA

RansomwareNone recordedNo known use recorded

Public exploits6reference, exploit-database, metasploit

Timeline

18-07-2013
PublishedVulnerability first disclosed.
25-03-2022
Added to CISA KEVApache Struts Improper Input Validation Vulnerability
15-04-2022
CISA remediation dueApply updates per vendor instructions.
22-10-2025
Last modifiedVulnerability information updated.

Description

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.19.8v2.09.3

EPSS trend

Probability

100.00%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 100.00% on 18-09-2026

18-09-202618-10-2026

EPSS score

100.00%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 25-03-2022
Federal due date: 15-04-2022

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2013-2251

Public exploits

6 found

referenceUnverified
Exploit Reference (seclists.org)
Maturity: unknown
referenceUnverified
Exploit Reference (cxsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown

Show all 6 exploits

exploit-databaseremotemultipleVerified
Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution (Metasploit)
Maturity: weaponized
exploit-databasemultipleVerified
Apache Struts2 2.0.0 < 2.3.15 - Prefixed Parameters OGNL Injection
Maturity: poc
MetasploitremoteVerified
Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
exploit/multi/http/struts_default_action_mapper
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected systems

Apache2 products

archiva≥ 1.3, < 1.3.8 | 1.2 | 1.2.2
struts≥ 2.0.0, ≤ 2.3.15

Fujitsu1 product

interstage_business_process_manager_analytics12.0 | 12.1

Oracle1 product

siebel_apps_-_e-billing6.1 | 6.1.1 | 6.2

Org.apache.struts1 product

struts2-core< 2.3.15.1

4 vendors · 5 products

References

22 links

www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.htmlX Refsource CONFIRMBroken LinkThird Party AdvisoryWEB
www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlX Refsource CONFIRMPatchThird Party AdvisoryWEB
exchange.xforce.ibmcloud.com/vulnerabilities/90392VDB EntryX Refsource XFThird Party AdvisoryWEB
seclists.org/fulldisclosure/2013/Oct/96Mailing ListX Refsource FULLDISCExploitThird Party AdvisoryWEB
cxsecurity.com/issue/WLB-2014010087X Refsource MISCExploitThird Party AdvisoryWEB
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2Vendor AdvisoryX Refsource CISCOThird Party AdvisoryWEB
struts.apache.org/release/2.3.x/docs/s2-016.htmlX Refsource CONFIRMPatchWEB
archiva.apache.org/security.htmlX Refsource CONFIRMProductWEB
osvdb.org/98445VDB EntryX Refsource OSVDBBroken Link
www.securitytracker.com/id/1032916VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory

Show all 22 references

www.securityfocus.com/bid/61189VDB EntryX Refsource BIDBroken LinkThird Party Advisory
www.securitytracker.com/id/1029184VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
www.securityfocus.com/bid/64758VDB EntryX Refsource BIDBroken LinkThird Party Advisory
www.oracle.com/technetwork/topics/security/cpujan2014-1972949.htmlX Refsource CONFIRMPatchThird Party AdvisoryWEB
seclists.org/oss-sec/2014/q1/89Mailing ListX Refsource MLISTThird Party AdvisoryWEB
packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.htmlX Refsource MISCExploitThird Party AdvisoryVDB EntryWEB
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2251Government ResourceUS Government ResourceWEB
nvd.nist.gov/vuln/detail/CVE-2013-2251Advisory
github.com/apache/struts/commit/3cfe34fefedcf0fdcfcb061c0aea34a715b7de6WEB
github.com/apache/struts/commit/630e1ba065a8215c4e9ac03bfb09be9d655c2b6eWEB
github.com/apache/strutsPACKAGE
issues.apache.org/jira/browse/WW-4140WEB