CVE-2013-2251
KEVCRITICAL 9.8EPSS 100.0%
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1 GitHub
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H - CVSS v2.0 NVD
- 9.3 HIGH
AV:N/AC:M/Au:N/C:C/I:C/A:C - EPSS
- 100.00% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2022-03-25
- Nuclei
- critical · CWE-20
- Published
- 2013-07-18
- Updated
- 2025-10-22
Proof-of-concept exploits (5)
- http://cxsecurity.com/issue/WLB-2014010087
- http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html
- fadelmuharam/s2-0161★ · 2022-12-12
- felixsta/hack_tips0★ · 2026-01-27
- nth347/CVE-2013-22510★ · 2023-08-04
Nuclei templates (1)
Metasploit modules (1)
ExploitDB entries (2)
Exploit collections (1)
- CVE-2013-2251.yamlzan8in/afrog
Security advisories
- http://seclists.org/fulldisclosure/2013/Oct/96
- http://seclists.org/oss-sec/2014/q1/89
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-st…
- http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analyti…
- http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- http://www.securityfocus.com/bid/61189
- http://www.securityfocus.com/bid/64758
- http://www.securitytracker.com/id/1029184
- http://www.securitytracker.com/id/1032916
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90392
- advisories/GHSA-47qp-8v9g-39hp
- http://struts.apache.org/release/2.3.x/docs/s2-016.html
- http://archiva.apache.org/security.html