CVE-2013-2251
Apache Struts Improper Input Validation Vulnerability
Description
CVE-2013-2251 is a critical security vulnerability affecting Apache Struts (versions >= 2.0.0, <= 2.3.15). Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions. CISA has added CVE-2013-2251 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 94.33% (100.0th percentile), this vulnerability has a very high probability of being exploited.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| apache | archiva | >= 1.3, < 1.3.8; 1.2; 1.2.2 |
| apache | struts | >= 2.0.0, <= 2.3.15 |
| fujitsu | interstage business process manager analytics | 12.0; 12.1 |
| oracle | siebel apps - e-billing | 6.1; 6.1.1; 6.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://archiva.apache.org/security.html(Product)
- http://cxsecurity.com/issue/WLB-2014010087(Exploit, Third Party Advisory)
- http://osvdb.org/98445(Broken Link)
- http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://seclists.org/fulldisclosure/2013/Oct/96(Exploit, Mailing List, Third Party Advisory)
- http://seclists.org/oss-sec/2014/q1/89(Mailing List, Third Party Advisory)
- http://struts.apache.org/release/2.3.x/docs/s2-016.html(Patch)
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2(Third Party Advisory)
- http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html(Broken Link, Third Party Advisory)
- http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html(Patch, Third Party Advisory)
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html(Patch, Third Party Advisory)
- http://www.securityfocus.com/bid/61189(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/64758(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1029184(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1032916(Broken Link, Third Party Advisory, VDB Entry)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90392(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2251(US Government Resource)
Weakness Type
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') describes a weakness where software fails to properly neutralize special elements in output that is used by a downstream component, enabling injection attacks. In CVE-2013-2251, Apache Struts is affected: Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions.
Learn more: CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Impact Analysis
CVE-2013-2251 poses a critical threat to organizations running Apache Struts, with a CVSS score of 9.8 reflecting maximum impact across confidentiality, integrity, and availability. Successful exploitation can fully compromise the confidentiality, integrity, and availability of affected systems. Attackers can access sensitive data, modify system configurations or data, and disrupt service availability. The network-based attack vector requiring no authentication makes this vulnerability particularly accessible to opportunistic attackers and automated scanning tools.
Exploit Maturity
CVE-2013-2251 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming real-world exploitation. The EPSS score of 94.33% (100.0th percentile) places it among the most likely vulnerabilities to be exploited, reflecting widespread and active exploitation activity. Public exploit code is available, lowering the barrier for attackers and increasing the urgency to patch. Despite being over 13 years old, this vulnerability continues to be relevant due to the persistence of unpatched legacy systems in production environments.
Remediation
- Apply vendor patches immediately as required by CISA KEV: Apply updates per vendor instructions. Upgrade Apache Struts from affected versions (>= 2.0.0, <= 2.3.15) to the latest patched release.
- If immediate patching is not possible, restrict network access to the affected Struts service using firewall rules, ACLs, or network segmentation to limit exposure to trusted networks only.
- Monitor affected systems for signs of compromise by reviewing security logs for anomalous activity, unauthorized access attempts, and unexpected system changes related to Struts.
- Evaluate whether affected Apache Struts deployments are still within vendor support. End-of-life systems should be prioritized for migration to supported alternatives.
- Review and update your organization's vulnerability management process to ensure CISA KEV entries with a remediation deadline of 2022-04-15 are addressed within the required timeframe.
Technical Details
CVE-2013-2251 is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')) affecting Apache Struts in versions >= 2.0.0, <= 2.3.15. Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions. The vulnerability is exploitable remotely over the network, with low attack complexity, requiring no prior authentication. The CVSS 3.1 base score of 9.8 (CRITICAL) reflects high confidentiality impact, high integrity impact, and high availability impact.
Frequently Asked Questions
Is CVE-2013-2251 being actively exploited?
Yes. CVE-2013-2251 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.33% (100.0th percentile) indicates a very high probability of exploitation. Public exploit code is available, further increasing the risk.
What products are affected by CVE-2013-2251?
CVE-2013-2251 primarily affects Apache Struts, as well as Apache Archiva, Fujitsu Interstage Business Process Manager Analytics, Fujitsu Gp7000f Firmware. The affected versions include >= 2.0.0, <= 2.3.15. Organizations should check whether any instances of the affected software are running in their environment.
How do I fix CVE-2013-2251?
Apply updates per vendor instructions. Specifically, upgrade from the affected versions (>= 2.0.0, <= 2.3.15) to the latest patched release from Apache. As an interim measure, restrict network access to the affected service to trusted networks only.
How severe is CVE-2013-2251?
CVE-2013-2251 has a CVSS 3.1 score of 9.8, rated CRITICAL. This critical rating reflects the vulnerability's potential for complete system compromise. The inclusion in the CISA KEV catalog means organizations are required to remediate this vulnerability within the specified deadline.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.