CVE-2013-2251

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 16, 2026

Description

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Jul 20, 2013
Last modified: Jun 16, 2026
Added to CISA KEV: Mar 25, 2022
NVD status: Analyzed

Related CVEs from 2013

CVE-2013-22545.0The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in CVE-2013-22555.9HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side CVE-2013-22566.0OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which CVE-2013-22577.5Cryptocat before 2.0.42 has Group Chat ECC Private Key Generation Brute Force Weakness CVE-2013-22585.3Cryptocat before 2.0.22 has Nickname User Impersonation CVE-2013-22599.8Cryptocat before 2.0.22 has Arbitrary Code Execution on Firefox Conversation Overview CVE-2013-22609.8Cryptocat before 2.0.22: Cryptocat.random() Function Array Key has Entropy Weakness CVE-2013-22617.5Cryptocat before 2.0.22 Chrome Extension 'img/keygen.gif' has Information Disclosure CVE-2013-22627.5Cryptocat strophe.js before 2.0.22 has information disclosure CVE-2013-22635.0Unspecified vulnerability in Citrix Access Gateway Standard Edition 5.0.x before 5.0.4.223524 allows remote attackers to access network reso CVE-2013-22645.0The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 CVE-2013-22667.8libdns in ISC BIND 9.7.x and 9.8.x before 9.8.4-P2, 9.8.5 before 9.8.5b2, 9.9.x before 9.9.2-P2, and 9.9.3 before 9.9.3b2 on UNIX platforms