CVE-2013-2251
KEVApache Struts Improper Input Validation Vulnerability
Description
Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions.
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HPublishedJul 20, 2013
Last modifiedJun 16, 2026
Added to KEVMar 25, 2022
Remediation dueApr 15, 2022
References
- archiva.apache.org/security.htmlProduct
- cxsecurity.com/issue/WLB-2014010087ExploitThird Party Advisory
- osvdb.org/98445Broken Link
- packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.htmlExploitThird Party Advisory
- seclists.org/fulldisclosure/2013/Oct/96ExploitMailing List
- seclists.org/oss-sec/2014/q1/89Mailing ListThird Party Advisory
- struts.apache.org/release/2.3.x/docs/s2-016.htmlPatch
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2Third Party Advisory
- fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.htmlBroken LinkThird Party Advisory
- oracle.com/technetwork/topics/security/cpujan2014-1972949.htmlPatchThird Party Advisory
- oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlPatchThird Party Advisory
- securityfocus.com/bid/61189Broken LinkThird Party Advisory
0 recent articles mention this CVE
89
Risk assessment · Critical
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1656 days
- CVSS
- 9.8 CRITICAL
- EPSS (30-day exploit probability)
- 100.0% · top 1% of all CVEs
- Weakness
- CWE-74
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.