CVE-2013-2251
9.8 · CRITICALActively ExploitedApache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
Overview
CVE-2013-2251 is a critical-severity vulnerability affecting apache archiva. It was published on July 20, 2013 and has a CVSS 3.1 base score of 9.8 (CRITICAL). This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.
This vulnerability has a CVSS 3.1 base score of 9.8, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.
Technical description
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
Remediation
Check the references section for vendor advisories and patches from apache. Update archiva to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
Affected products
| Vendor | Product | Versions | Status |
|---|---|---|---|
| apache | archiva | >= 1.3, < 1.3.8 | Affected |
| apache | struts | 2.0.0 | Affected |
| redhat | enterprise_linux | 5.0 | Affected |
References
How CyberStrike helps
Reason, not just scan
It reasons through your app's logic the way a human pentester would, so it finds flaws signature scanners miss.
Learn moreVerified findings
Every finding is proven exploitable before you see it, which cuts the false positives that bury real risk.
Learn moreAI-driven DAST and SAST
Probe running apps and read source from one engine, so issues are caught before and after they ship.
Learn moreOpen source
Read exactly how it tests and what it reports. CyberStrike is open source and in early access.
View the repo
Frequently asked questions
What is CVE-2013-2251?
CVE-2013-2251 is a critical-severity vulnerability affecting apache archiva. It was published on July 20, 2013 and has a CVSS 3.1 base score of 9.8 (CRITICAL). This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.
How severe is CVE-2013-2251?
This vulnerability has a CVSS 3.1 base score of 9.8, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.
How do I fix or remediate CVE-2013-2251?
Check the references section for vendor advisories and patches from apache. Update archiva to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
How can CyberStrike help with CVE-2013-2251?
CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2013-2251 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.
Related CRITICAL CVEs from 2013
View all- 10.0CVE-2012-6069
The CoDeSys Runtime Toolkit’s file transfer functionality does not perform input validation, which
View details - 9.8CVE-2013-0625
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers t
View details - 9.8CVE-2013-0422
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitra
View details - 9.8CVE-2013-0632
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass au
View details - 9.8CVE-2012-6068
The Runtime Toolkit in CODESYS Runtime System 2.3.x and 2.4.x does not require authentication, which
View details - 9.8CVE-2012-6437
The device does not properly authenticate users and the potential exists for a remote user to upload
View details - 9.8CVE-2013-1591
Stack-based buffer overflow in libpixman, as used in Pale Moon before 15.4 and possibly other produc
View details - 9.8CVE-2013-1465
The Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows re
View details - 9.8CVE-2013-2729
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 1
View details - 9.8CVE-2011-1180
Multiple stack-based buffer overflows in the iriap_getvaluebyclass_indication function in net/irda/i
View details - 9.8CVE-2013-2465
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update
View details - 9.8CVE-2013-3346
Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attacke
View details