CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2013-2251
Critical (9.8) in Apache Struts. In CISA KEV since 2022-03-25. EPSS 100% chance of exploitation in the next 30 days. Fixed in org.apache.struts:struts2-core 2.3.15.1.
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
Severity
- EPSS
- 100% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2022-03-25, due 2022-04-15
- CWE
- CWE-74
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:archiva
- apache:struts
- fujitsu:interstage_business_process_manager_analytics
- oracle:siebel_apps_-_e-billing
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-47qp-8v9g-39hp | Maven | org.apache.struts:struts2-core | <2.3.15.1 | 2.3.15.1 |