Cyber Resilience

CVE-2013-2251

CriticalCISA KEVActive ExploitationEUVD ExploitedPublic PoC

Published: 20 July 2013

Published
20 July 2013
Modified
22 April 2026
KEV Added
25 March 2022
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.9433 100.0th percentile
Risk Priority 96 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2013-2251 is a critical-severity Injection (CWE-74) vulnerability in Apache Archiva. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

Apache Struts versions 2.0.0 through 2.3.15 contain a flaw that allows remote attackers to execute arbitrary OGNL expressions by supplying a parameter containing a crafted action:, redirect:, or redirectAction: prefix. The issue is tracked as CWE-74 and assigned a CVSS 3.1 score of 9.8 reflecting network attack vector, low complexity, and no required privileges or user interaction.

An unauthenticated attacker can therefore submit malicious input to trigger OGNL evaluation, resulting in arbitrary code execution that compromises confidentiality, integrity, and availability of the application server.

Public references list the vulnerability in multiple exploit archives and disclosure lists dating from 2013, confirming the availability of proof-of-concept material.

EU & UK References

Vulnerability details

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

CWE(s)
CWE-74
KEV Date Added
25 March 2022

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

apache
archiva
1.2, 1.2.2 · 1.3 — 1.3.8
apache
struts
2.0.0 — 2.3.15
fujitsu
interstage business process manager analytics
12.0, 12.1
oracle
siebel apps - e-billing
6.1, 6.1.1, 6.2

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of all input parameters to reject crafted action:, redirect:, or redirectAction: prefixes before OGNL evaluation occurs.

SI-2 Flaw Remediation good match
prevent

Mandates timely application of security patches to eliminate the vulnerable Struts 2.0.0-2.3.15 code paths that permit OGNL injection.

AC-4 Information Flow Enforcement partial match
prevent

Enforces information flow rules that can block untrusted parameter values from reaching the OGNL expression evaluator.

References