CVE-2013-2251 Apache Struts
| Affected software | Apache Struts |
|---|---|
| Severity | 9.8 Critical CVSS 3.1 3 scores |
| Fixed in | 2.3.15.1 |
| Weakness | Improper input validation (CWE-20) |
| Published | 20 Jul 2013 |
| Updated | 13 Nov 2026 |
Description
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
CWE-74
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2022-03-25 · remediation due 2022-04-15 · ransomware use: unknown
- VulnCheck KEV listed Exploitation reported in the wild. 5 citations · honeypot sightings · 2 exploits · earliest 2020-10-14.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
- Indexed PoC 5 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2013-07-27.
- EPSS 99.9% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2013-2251 in VulnCheck (free account).
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | Shadowserver honeypots | Exploitation attempts seen on 36 days | 2026-09-16 to 2026-11-12 |
| Reported exploitation | unit42.paloaltonetworks.com | /iot-vulnerabilities-mirai-payloads | 2020-10-14 |
| Reported exploitation | cisa.gov | /sites/default/files/feeds/known_exploited_vulnerabilities.json | 2022-03-25 |
| Reported exploitation | veriti.ai | /blog/vulnerable-villain-when-hackers-get-hacked | 2024-04-15 |
| Reported exploitation | f5.com | /labs/articles/threat-intelligence/continued-scanning-for-cve-2023-1389 | 2025-01-21 |
| Reported exploitation | labs.greynoise.io | /grimoire/2025-12-26-coldfusion | 2025-12-26 |
| Exploit reference | VulnCheck XDB 3aaed1d77828 | Exploit type: initial-access | 2024-02-01 |
| Exploit reference | VulnCheck XDB eb0556987a2c | Exploit type: initial-access | 2024-10-21 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | Vulnerable environment of CVE-2013-2251 (S2-016) for testing | 2023-08-04 | |
| Exploit-DB | Apache Struts2 2.0.0 < 2.3.15 - Prefixed Parameters OGNL Injection | 2014-01-14 | |
| Exploit-DB | Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution (Metasploit) | 2013-07-27 | |
| Nuclei | Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution | ||
| Metasploit | Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution (excellent rank) |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Process
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the ARMR Process rule. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: ARMR Process rule
Exploitation forks a process. Blocked by the Process rule in PROTECT mode.
Only stops attacks that start a program; an expression that reads files or data directly in Java is not stopped.
How to mitigate CVE-2013-2251
Upgrade Apache Struts to 2.3.15.1 or later. Until you can, Waratek RASP blocks exploitation with its process rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
9.8 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
CVSS
9.8 CRITICAL v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CISA-ADP | Secondary | |
| CVSS 2.0 | 9.3 | none | AV:N/AC:M/Au:N/C:C/I:C/A:C |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update July 2015 ↗ | CPU | 2015-Q3 | Oracle Siebel CRM / Siebel Apps - E-Billing (6.1, 6.1.1, 6.2) |
| Oracle Critical Patch Update October 2013 ↗ | CPU | 2013-Q4 | Oracle Financial Services Software / Oracle FLEXCUBE Private Banking (1.7, 2.0, 2.0.1, 2.2.0.1, 3.0, 12.0.1) Oracle's note: The following CVEs are fixed as a result of upgrading to Struts 2.3.15.1: CVE-2013-2251, CVE-2013-2248, CVE-2013-2135, and CVE-2013-2134. Oracle MySQL / MySQL Enterprise Monitor (2.3.13 and earlier) Oracle's note: The following CVEs are fixed as a result of upgrading to Struts 2.3.15.1: CVE-2013-2251, CVE-2013-2248, CVE-2013-2135, and CVE-2013-2134. The CVSS score is 8.5 if MySQL Enterprise Monitor runs with admin or root privileges. The score would be 6.0 if MySQL Enterprise Monitor runs with non-admin privileges and the impact on Confidentiality, Integrity and Availability would be Partial. |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Financial Services Software | Oracle FLEXCUBE Private Banking | 1.7, 2.0, 2.0.1, 2.2.0.1, 3.0, 12.0.1 | 1.7 · 2.0 · 2.0.1 · 2.2.0.1 · 3.0 · 12.0.1 |
| Oracle MySQL | MySQL Enterprise Monitor | 2.3.13 and earlier | |
| Oracle Siebel CRM | Siebel Apps - E-Billing | 6.1, 6.1.1, 6.2 | 6.1 · 6.1.1 · 6.2 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.struts:struts2-core |
0 | 2.3.15.1 |
unbounded |
Products and versions
5 products, 10 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | archiva | generic | 1.2 · 1.2.2 · ≥ 1.3 and ＜ 1.3.8 |
| nvd | apache | struts | generic | ≥ 2.0.0 and ≤ 2.3.15 |
| nvd | fujitsu | interstage business process manager analytics | generic | 12.0 · 12.1 |
| nvd | oracle | siebel apps - e-billing | generic | 6.1 · 6.1.1 · 6.2 |
| osv | org.apache.struts | struts2-core | generic | ＜ 2.3.15.1 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** HTTP, CORE, HTTPS, SEE NOTE 1, SERVICE MANAGER, NO AUTH REMOTE EXPLOIT, SECURITY **Products:** ORACLE FLEXCUBE PRIVATE BANKING, ORACLE FINANCIAL SERVICES SOFTWARE, SIEBEL APPS - E-BILLING, MYSQL ENTERPRISE MONITOR, ORACLE SIEBEL CRM, ORACLE MYSQL
References
Timeline
Timeline
| Published | 2013-07-20 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2020-10-14 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| Added to CISA KEV | 2022-03-25 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| NVD record modified | 2026-06-16 | NVD's own last-modified date for this record. |
| VulnCheck KEV: latest evidence | 2026-11-12 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |
| Last VRT activity | 2026-11-13 | Most recent commit touching this CVE's classification, patch or rule file. |