CVE-2013-2248

Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.

CVSS v2.0 NVD

5.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N

EPSS

94.65% chance of exploitation in the next 30 days, 100th percentile

Nuclei

medium · CWE-20

Published

2013-07-18

Updated

2024-08-06

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-2248.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/38666

Security advisories

• http://struts.apache.org/release/2.3.x/docs/s2-017.html
• advisories/GHSA-rpj9-r897-wc6q
• http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
• http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
• http://www.securityfocus.com/bid/61196
• http://www.securityfocus.com/bid/64758

References

• CVE Record
• NVD entry