CVE-2013-6348
Apache Struts is vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or HTML via the namespace parameter to (1) actionNames.action and (2) showConfig.action in config-browser/.
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or HTML via the namespace parameter to (1) actionNames.action and (2) showConfig.action in config-browser/.
- Record
CVE-2013-6348- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or HTML via the namespace parameter to (1) actionNames.action and (2) showConfig.action in config-browser/.
- Record
CVE-2013-6348- Updated
- 2026-11-02
EUVDEUVD-2022-2177 No score
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or HTML via the namespace parameter to (1) actionNames.action and (2) showConfig.action in config-browser/.
- Record
EUVD-2022-2177- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3g8j-jj54-3vjg No score
Apache Struts is vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or HTML via the namespace parameter to (1) actionNames.action and (2) showConfig.action in config-browser/.
- Record
GHSA-3g8j-jj54-3vjg- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-3g8j-jj54-3vjg No score
Apache Struts is vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or HTML via the namespace parameter to (1) actionNames.action and (2) showConfig.action in config-browser/.
- Record
GHSA-3g8j-jj54-3vjg- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts:struts2-coreMaven |
before 2.3.16 | 2.3.16 |
org.apache.struts:struts2-coreMaven |
before 2.3.16, plus listed versions 2.0.112.0.11.12.0.11.22.0.122.0.14 Show 29 moreShow less2.0.52.0.62.0.82.0.92.1.22.1.62.1.82.1.8.12.2.12.2.1.12.2.32.2.3.12.3.12.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.15.22.3.15.32.3.32.3.42.3.4.12.3.72.3.8 |
2.3.16 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-6348 is a medium vulnerability (CVSS 4.3) in Apache Struts, published November 2, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.12%, the 93rd percentile. Fixed in org.apache.struts:struts2-core 2.3.16.