Log in Start free

Actively exploited · Published Jul 18, 2013 · Assigned by redhat

CVE-2013-2251

Critical 9.8 Exploited

In plain English

A critical-severity injection in Struts from Apache. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)100.0%top 0.0% of all CVEs
Exploited in the wildYesCISA KEV since Mar 25, 2022
Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 15, 2022.

Official description

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.apache.struts:struts2-core2.3.15.1GHSA-47qp-8v9g-39hp

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References