Read the docs
TI-2013-02010 Aliases CVE-2013-2248GHSA-rpj9-r897-wc6q

Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote…

Priority HIGH 70CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub.

Summary

Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.

Why it matters now

EPSS 0.94654 99th percentileScored 2026-11-07
Fix Fixed org.apache.struts:struts2-core (Maven): 2.3.15.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.struts:struts2-core (Maven)before 2.3.15.12.3.15.1Patch availableGHSA-rpj9-r897-wc6q
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.struts:struts2-core (Maven) Vendor— Affected before 2.3.15.1 Fixed in 2.3.15.1 Patch available GHSA-rpj9-r897-wc6q

CPE configurations NVD · 44

CPEVersionsRoleVendor
cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableApache
cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableApache
cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*2.0.2VulnerableApache
cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*2.0.3VulnerableApache
cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*2.0.4VulnerableApache
cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*2.0.5VulnerableApache
cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*2.0.6VulnerableApache
cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*2.0.7VulnerableApache
cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*2.0.8VulnerableApache
cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*2.0.9VulnerableApache
  • cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:* Versions 2.0.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:* Versions 2.0.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:* Versions 2.0.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:* Versions 2.0.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:* Versions 2.0.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:* Versions 2.0.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:* Versions 2.0.9 Vulnerable ·Apache
Show 34 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*2.0.10VulnerableApache
cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*2.0.11VulnerableApache
cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*2.0.11.1VulnerableApache
cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*2.0.11.2VulnerableApache
cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*2.0.12VulnerableApache
cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*2.0.13VulnerableApache
cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*2.0.14VulnerableApache
cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableApache
cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*2.1.1VulnerableApache
cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*2.1.2VulnerableApache
cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*2.1.3VulnerableApache
cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*2.1.4VulnerableApache
cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*2.1.5VulnerableApache
cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*2.1.6VulnerableApache
cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*2.1.8VulnerableApache
cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*2.1.8.1VulnerableApache
cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*2.2.1VulnerableApache
cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*2.2.1.1VulnerableApache
cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:*2.2.3VulnerableApache
cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:*2.2.3.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:*2.3.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*2.3.1.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*2.3.1.2VulnerableApache
cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*2.3.3VulnerableApache
cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*2.3.4VulnerableApache
cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:*2.3.4.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:*2.3.7VulnerableApache
cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:*2.3.8VulnerableApache
cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:*2.3.12VulnerableApache
cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:*2.3.14VulnerableApache
cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:*2.3.14.1VulnerableApache
cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:*2.3.14.2VulnerableApache
cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:*2.3.14.3VulnerableApache
cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:*2.3.15VulnerableApache
  • cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:* Versions 2.0.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:* Versions 2.0.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:* Versions 2.0.11.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:* Versions 2.0.11.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:* Versions 2.0.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:* Versions 2.0.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:* Versions 2.0.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:* Versions 2.1.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:* Versions 2.1.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:* Versions 2.1.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:* Versions 2.1.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:* Versions 2.1.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:* Versions 2.1.8.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:* Versions 2.2.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:* Versions 2.2.3.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:* Versions 2.3.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:* Versions 2.3.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:* Versions 2.3.1.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:* Versions 2.3.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:* Versions 2.3.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:* Versions 2.3.4.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:* Versions 2.3.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:* Versions 2.3.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:* Versions 2.3.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:* Versions 2.3.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:* Versions 2.3.14.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:* Versions 2.3.14.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:* Versions 2.3.14.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:* Versions 2.3.15 Vulnerable ·Apache

Remediation

  • Fix · GHSA-rpj9-r897-wc6q org.apache.struts:struts2-core (Maven) Fixed in 2.3.15.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-2248
  2. 2026-10-03 Alias added: GHSA-rpj9-r897-wc6q

References

Advisory 2

Other 7

  • TI-2020-13278 Expression language injection in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-07171 Improper input validation in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2013-02013 Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL… KEVCVSS 3.1CRITICAL 9.8
  • TI-2012-00357 The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-08433 Improper input validation in Apache Struts KEVCVSS 3.1HIGH 8.1
See all 98 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences