CVE-2013-2251
Code injection in Apache Struts
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
- Record
CVE-2013-2251- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-74
- Updated
- 2026-11-02
CVE List
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
- Record
CVE-2013-2251- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
EUVDEUVD-2022-2328
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
- Record
EUVD-2022-2328- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-47qp-8v9g-39hp
Code injection in Apache Struts
The Struts 2 DefaultActionMapper supports a method for short-circuit navigation state changes by prefixing parameters with "action:" or "redirect:", followed by a desired navigational target expression. This mechanism was intended to help with attaching navigational information to buttons within forms.
In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
- Record
GHSA-47qp-8v9g-39hp- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H - Weakness
- CWE-20, CWE-74
- Updated
- 2026-11-02
CISA KEV No score
Apache Struts Improper Input Validation Vulnerability
Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions.
- Record
CVE-2013-2251- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-47qp-8v9g-39hp
Code injection in Apache Struts
The Struts 2 DefaultActionMapper supports a method for short-circuit navigation state changes by prefixing parameters with "action:" or "redirect:", followed by a desired navigational target expression. This mechanism was intended to help with attaching navigational information to buttons within forms.
In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
- Record
GHSA-47qp-8v9g-39hp- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H - Weakness
- CWE-20, CWE-74
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts:struts2-coreMaven |
before 2.3.15.1 | 2.3.15.1 |
org.apache.struts:struts2-coreMaven |
before 2.3.15.1, plus listed versions 2.0.112.0.11.12.0.11.22.0.122.0.14 Show 26 moreShow less2.0.52.0.62.0.82.0.92.1.22.1.62.1.82.1.8.12.2.12.2.1.12.2.32.2.3.12.3.12.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.32.3.42.3.4.12.3.72.3.8 |
2.3.15.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution | 2013-07-02 |
| Exploit-DB | Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution (Metasploit) | 2013-07-27 |
| Exploit-DB | Apache Struts2 2.0.0 < 2.3.15 - Prefixed Parameters OGNL Injection | 2014-01-14 |
| PoC in GitHub | nth347/struts2-CVE-2013-2251 | 2023-08-04 |
| Nuclei | Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-2251 is a critical vulnerability (CVSS 9.8) in Apache Struts, published July 18, 2013. CISA lists it as known to be exploited, since March 25, 2022. EUVD reports exploitation since March 25, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. Fixed in org.apache.struts:struts2-core 2.3.15.1.
References
fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html
oracle.com/technetwork/topics/security/cpujul2015-2367936.html
exchange.xforce.ibmcloud.com/vulnerabilities/90392
seclists.org/fulldisclosure/2013/Oct/96
cxsecurity.com/issue/WLB-2014010087
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2
Show 17 moreShow less
struts.apache.org/release/2.3.x/docs/s2-016.html
archiva.apache.org/security.html
osvdb.org/98445
securitytracker.com/id/1032916
securityfocus.com/bid/61189
packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2251
nvd.nist.gov/vuln/detail/CVE-2013-2251
github.com/apache/struts/commit/3cfe34fefedcf0fdcfcb061c0aea34a715b7de6
issues.apache.org/jira/browse/WW-4140