CVE-2013-2251

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2013-2251
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.3 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://archiva.apache.org/security.html Product
http://cxsecurity.com/issue/WLB-2014010087 Exploit Third Party Advisory
http://osvdb.org/98445 Broken Link
http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2013/Oct/96 Exploit Mailing List Third Party Advisory
http://seclists.org/oss-sec/2014/q1/89 Mailing List Third Party Advisory
http://struts.apache.org/release/2.3.x/docs/s2-016.html Patch
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2 Third Party Advisory
http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html Patch Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html Patch Third Party Advisory
http://www.securityfocus.com/bid/61189 Broken Link Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/64758 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1029184 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1032916 Broken Link Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/90392 Third Party Advisory VDB Entry
http://archiva.apache.org/security.html Product
http://cxsecurity.com/issue/WLB-2014010087 Exploit Third Party Advisory
http://osvdb.org/98445 Broken Link
http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2013/Oct/96 Exploit Mailing List Third Party Advisory
http://seclists.org/oss-sec/2014/q1/89 Mailing List Third Party Advisory
http://struts.apache.org/release/2.3.x/docs/s2-016.html Patch
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2 Third Party Advisory
http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html Patch Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html Patch Third Party Advisory
http://www.securityfocus.com/bid/61189 Broken Link Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/64758 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1029184 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1032916 Broken Link Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/90392 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:apache:archiva:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:archiva:1.2:-:*:*:*:*:*:*
cpe:2.3:a:apache:archiva:1.2.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:a:fujitsu:interstage_business_process_manager_analytics:12.0:*:*:*:*:*:*:*
OR cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:*:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:a:fujitsu:interstage_business_process_manager_analytics:12.1:*:*:*:*:*:*:*
OR cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:*:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:fujitsu:gp7000f_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:fujitsu:gp7000f:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:fujitsu:primepower_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:fujitsu:primepower:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:fujitsu:gp-s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:fujitsu:gp-s:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:fujitsu:primergy_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:fujitsu:primergy:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:fujitsu:gp5000_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:fujitsu:gp5000:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:fujitsu:sparc_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:fujitsu:sparc:-:*:*:*:*:*:*:*

Configuration 10 (hide)

OR cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.1.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.2:*:*:*:*:*:*:*
History

No history.

Information

Published : 2013-07-20 03:37

Updated : 2025-04-11 00:51

NVD link : CVE-2013-2251

Mitre link : CVE-2013-2251

CVE.ORG link : CVE-2013-2251

JSON object : View

Products Affected

fujitsu

  • primepower
  • sparc
  • gp5000
  • gp-s_firmware
  • sparc_firmware
  • gp7000f_firmware
  • interstage_business_process_manager_analytics
  • primepower_firmware
  • gp7000f
  • primergy
  • primergy_firmware
  • gp5000_firmware
  • gp-s

microsoft

  • windows_server_2003
  • windows_server_2012
  • windows_server_2008

oracle

  • siebel_apps_-_e-billing
  • solaris

apache

  • archiva
  • struts

redhat

  • enterprise_linux
CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')