CVE-2013-2248

MediumCVSS 5.8/10Last modified Jun 16, 2026

Description

Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.

Metrics

CVSS 2.0 5.8/10AV:N/AC:M/Au:N/C:P/I:P/A:N

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Jul 20, 2013
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2013

CVE-2013-22497.5mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for a session without cCVE-2013-225010.0Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to eCVE-2013-22519.8Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:,CVE-2013-22545.0The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 inCVE-2013-22555.9HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-sideCVE-2013-22566.0OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, whichCVE-2013-22577.5Cryptocat before 2.0.42 has Group Chat ECC Private Key Generation Brute Force WeaknessCVE-2013-22585.3Cryptocat before 2.0.22 has Nickname User ImpersonationCVE-2013-22599.8Cryptocat before 2.0.22 has Arbitrary Code Execution on Firefox Conversation OverviewCVE-2013-22609.8Cryptocat before 2.0.22: Cryptocat.random() Function Array Key has Entropy WeaknessCVE-2013-22617.5Cryptocat before 2.0.22 Chrome Extension 'img/keygen.gif' has Information DisclosureCVE-2013-22627.5Cryptocat strophe.js before 2.0.22 has information disclosure