Read the docs
TI-2013-02013 Aliases CVE-2013-2251GHSA-47qp-8v9g-39hp

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL…

Priority CRITICAL 100Exploited in the wildCWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

Why it matters now

Exploitation Active In CISA KEV since 2022-03-25CISA due date 2022-04-15
EPSS 0.99998 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed org.apache.struts:struts2-core (Maven): 2.3.15.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.struts:struts2-core (Maven)before 2.3.15.12.3.15.1Patch availableGHSA-47qp-8v9g-39hp
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.struts:struts2-core (Maven) Vendor— Affected before 2.3.15.1 Fixed in 2.3.15.1 Patch available GHSA-47qp-8v9g-39hp

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:apache:archiva:*:*:*:*:*:*:*:*1.3 to before 1.3.8VulnerableApache
cpe:2.3:a:apache:archiva:1.2:-:*:*:*:*:*:*1.2VulnerableApache
cpe:2.3:a:apache:archiva:1.2.2:*:*:*:*:*:*:*1.2.2VulnerableApache
cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*2.0.0 – 2.3.15VulnerableApache
cpe:2.3:a:fujitsu:interstage_business_process_manager_analytics:12.0:*:*:*:*:*:*:*12.0VulnerableFujitsu
cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:redhat:enterprise_linux:*:*:*:*:*:*:*:*5.0 – 6.10Running onRed Hat
cpe:2.3:a:fujitsu:interstage_business_process_manager_analytics:12.1:*:*:*:*:*:*:*12.1VulnerableFujitsu
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:apache:archiva:*:*:*:*:*:*:*:* Versions 1.3 to before 1.3.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:archiva:1.2:-:*:*:*:*:*:* Versions 1.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:archiva:1.2.2:*:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* Versions 2.0.0 – 2.3.15 Vulnerable ·Apache
  • cpe:2.3:a:fujitsu:interstage_business_process_manager_analytics:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Fujitsu
  • cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:redhat:enterprise_linux:*:*:*:*:*:*:*:* Versions 5.0 – 6.10 Running on ·Red Hat
  • cpe:2.3:a:fujitsu:interstage_business_process_manager_analytics:12.1:*:*:*:*:*:*:* Versions 12.1 Vulnerable ·Fujitsu
  • cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:*11Running onOracle
cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.1:*:*:*:*:*:*:*6.1VulnerableOracle
cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.1.1:*:*:*:*:*:*:*6.1.1VulnerableOracle
cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.2:*:*:*:*:*:*:*6.2VulnerableOracle
  • cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:* Versions 11 Running on ·Oracle
  • cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.1:*:*:*:*:*:*:* Versions 6.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.1.1:*:*:*:*:*:*:* Versions 6.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.2:*:*:*:*:*:*:* Versions 6.2 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-47qp-8v9g-39hp org.apache.struts:struts2-core (Maven) Fixed in 2.3.15.1 Advisory →

Timeline

  1. 2022-03-25 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2013-2251
  3. 2026-10-03 Alias added: GHSA-47qp-8v9g-39hp

References

Exploit 2

Patch 3

Advisory 4

Other 7

  • TI-2016-03842 Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and… CVSS 3.0HIGH 8.8
  • TI-2024-17994 Apache Archiva: incorrect authentication potentially leading to account takeover CVSS 3.1HIGH 7.5
  • TI-2024-17993 Apache Archiva: disabling user registration is not effective CVSS 3.1HIGH 7.5
  • TI-2010-03281 Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in… CVSS 2.0MEDIUM 6.8
  • TI-2019-00186 Cross-site scripting in Apache Archiva CVSS 3.0MEDIUM 6.5
  • TI-2022-19145 Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files CVSS 3.1HIGH 7.5
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences