CVE-2013-2251

CriticalPublished

Apache Struts Improper Input Validation Vulnerability

Published: Jul 18, 2013
Updated: Oct 22, 2025
Assigning CNA: redhat
Evidence observed: Jul 27, 2013

Primary CVSS

9.8/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability estimate

100.0%

High · next 30 days

Percentile: 100.0%
Model date: Oct 13, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

CISA Known Exploited

This CVE appears in the CISA Known Exploited Vulnerabilities catalog.

Summary

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

Sources

Repository evidence: Files: 3 · Repositories: 3

1 Module1 Template1 Lab

Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code ExecutionTemplate
http/cves/2013/CVE-2013-2251.yaml
Nuclei Templates
DetectionEvidence observed: Sep 25, 2026Revision: 56852ca76f4dRelated tool
Declared conditions
- network: http($.protocol_keys)
- verification: regex,status($.matchers[*].type)
S2-016 Remote Code ExecutionLab
struts2/s2-016
S2-016 Remote Code Execution Vulnerablity
Vulhub vulnerability labs
ResearchEvidence observed: Sep 25, 2026Revision: 8fd63916f7a8Related tool
Apache Struts 2 DefaultActionMapper Prefixes OGNL Code ExecutionModule
modules/exploits/multi/http/struts_default_action_mapper.rb
Metasploit Framework modules
ExploitEvidence observed: Sep 26, 2026Revision: 28f4223c60caRelated tool
Declared conditions
- platform: Linux,Windows($.exploit_multi/http/struts_default_action_mapper.platform)
- verification: check_declared($.exploit_multi/http/struts_default_action_mapper.check)

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.