CVE-2013-2251

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

CVSS v3 9.8 CRITICAL
CVSS v2.0 9.3 HIGH

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.3^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://archiva.apache.org/security.html	Product
http://cxsecurity.com/issue/WLB-2014010087	Exploit Third Party Advisory
http://osvdb.org/98445	Broken Link
http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html	Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2013/Oct/96	Exploit Mailing List Third Party Advisory
http://seclists.org/oss-sec/2014/q1/89	Mailing List Third Party Advisory
http://struts.apache.org/release/2.3.x/docs/s2-016.html	Patch
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2	Third Party Advisory
http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html	Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html	Patch Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html	Patch Third Party Advisory
http://www.securityfocus.com/bid/61189	Broken Link Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/64758	Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1029184	Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1032916	Broken Link Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/90392	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:archiva::::::::
	cpe:2.3:a:apache:archiva:1.2:-::::::
	cpe:2.3:a:apache:archiva:1.2.2:::::::*
	cpe:2.3:a:apache:struts::::::::

Configuration 2 (hide)

AND

cpe:2.3:a:fujitsu:interstage_business_process_manager_analytics:12.0:*:*:*:*:*:*:*

OR	cpe:2.3:o:microsoft:windows_server_2003:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2008:-:::::::*
	cpe:2.3:o:redhat:enterprise_linux::::::::

Configuration 3 (hide)

AND

cpe:2.3:a:fujitsu:interstage_business_process_manager_analytics:12.1:*:*:*:*:*:*:*

OR	cpe:2.3:a:oracle:solaris:11:::::::*
	cpe:2.3:o:microsoft:windows_server_2003:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2008:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
	cpe:2.3:o:redhat:enterprise_linux::::::::

Configuration 4 (hide)

AND

cpe:2.3:o:fujitsu:gp7000f_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:fujitsu:gp7000f:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:fujitsu:primepower_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:fujitsu:primepower:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND

cpe:2.3:o:fujitsu:gp-s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:fujitsu:gp-s:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND

cpe:2.3:o:fujitsu:primergy_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:fujitsu:primergy:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND

cpe:2.3:o:fujitsu:gp5000_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:fujitsu:gp5000:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND

cpe:2.3:o:fujitsu:sparc_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:fujitsu:sparc:-:*:*:*:*:*:*:*

Configuration 10 (hide)

OR	cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.1:::::::*
	cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.1.1:::::::*
	cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.2:::::::*

History

16 Jul 2024, 17:57

Information

Published : 2013-07-20 03:37

Updated : 2024-07-16 17:57

NVD link : CVE-2013-2251

Mitre link : CVE-2013-2251

CVE.ORG link : CVE-2013-2251

JSON object : View

Products Affected

fujitsu

gp-s
sparc_firmware
primergy_firmware
gp7000f_firmware
primergy
gp5000
gp5000_firmware
interstage_business_process_manager_analytics
primepower_firmware
primepower
gp7000f
gp-s_firmware
sparc

microsoft

windows_server_2012
windows_server_2003
windows_server_2008

oracle

siebel_apps_-_e-billing
solaris

apache

struts
archiva

redhat

enterprise_linux

CWE

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Type	Values Removed	Values Added
References	~~() http://archiva.apache.org/security.html -~~	() http://archiva.apache.org/security.html - Product
References	~~() http://cxsecurity.com/issue/WLB-2014010087 -~~	() http://cxsecurity.com/issue/WLB-2014010087 - Exploit, Third Party Advisory
References	~~() http://osvdb.org/98445 -~~	() http://osvdb.org/98445 - Broken Link
References	~~() http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html -~~	() http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry
References	~~() http://seclists.org/fulldisclosure/2013/Oct/96 -~~	() http://seclists.org/fulldisclosure/2013/Oct/96 - Exploit, Mailing List, Third Party Advisory
References	~~() http://seclists.org/oss-sec/2014/q1/89 -~~	() http://seclists.org/oss-sec/2014/q1/89 - Mailing List, Third Party Advisory
References	~~() http://struts.apache.org/release/2.3.x/docs/s2-016.html - Patch, Vendor Advisory~~	() http://struts.apache.org/release/2.3.x/docs/s2-016.html - Patch
References	~~() http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2 -~~	() http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2 - Third Party Advisory
References	~~() http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html -~~	() http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html - Third Party Advisory
References	~~() http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html -~~	() http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html - Patch, Third Party Advisory
References	~~() http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html - Patch, Vendor Advisory~~	() http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html - Patch, Third Party Advisory
References	~~() http://www.securityfocus.com/bid/61189 -~~	() http://www.securityfocus.com/bid/61189 - Broken Link, Third Party Advisory, VDB Entry
References	~~() http://www.securityfocus.com/bid/64758 -~~	() http://www.securityfocus.com/bid/64758 - Broken Link, Third Party Advisory, VDB Entry
References	~~() http://www.securitytracker.com/id/1029184 -~~	() http://www.securitytracker.com/id/1029184 - Broken Link, Third Party Advisory, VDB Entry
References	~~() http://www.securitytracker.com/id/1032916 -~~	() http://www.securitytracker.com/id/1032916 - Broken Link, Third Party Advisory, VDB Entry
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/90392 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/90392 - Third Party Advisory, VDB Entry
CPE	cpe:2.3:a:apache:struts:2.3.14:::::::* cpe:2.3:a:apache:struts:2.3.7:::::::* cpe:2.3:a:apache:struts:2.1.3:::::::* cpe:2.3:a:apache:struts:2.1.1:::::::* cpe:2.3:a:apache:struts:2.0.9:::::::* cpe:2.3:a:apache:struts:2.3.12:::::::* cpe:2.3:a:apache:struts:2.3.15:::::::* cpe:2.3:a:apache:struts:2.1.0:::::::* cpe:2.3:a:apache:struts:2.0.11.2:::::::* cpe:2.3:a:apache:struts:2.3.1:::::::* cpe:2.3:a:apache:struts:2.3.8:::::::* cpe:2.3:a:apache:struts:2.0.5:::::::* cpe:2.3:a:apache:struts:2.0.12:::::::* cpe:2.3:a:apache:struts:2.0.13:::::::* cpe:2.3:a:apache:struts:2.0.4:::::::* cpe:2.3:a:apache:struts:2.1.2:::::::* cpe:2.3:a:apache:struts:2.2.3:::::::* cpe:2.3:a:apache:struts:2.0.0:::::::* cpe:2.3:a:apache:struts:2.3.4:::::::* cpe:2.3:a:apache:struts:2.2.1.1:::::::* cpe:2.3:a:apache:struts:2.3.14.3:::::::* cpe:2.3:a:apache:struts:2.1.6:::::::* cpe:2.3:a:apache:struts:2.0.2:::::::* cpe:2.3:a:apache:struts:2.3.1.2:::::::* cpe:2.3:a:apache:struts:2.0.3:::::::* cpe:2.3:a:apache:struts:2.1.8.1:::::::* cpe:2.3:a:apache:struts:2.3.14.1:::::::* cpe:2.3:a:apache:struts:2.3.14.2:::::::* cpe:2.3:a:apache:struts:2.1.4:::::::* cpe:2.3:a:apache:struts:2.1.8:::::::* cpe:2.3:a:apache:struts:2.0.14:::::::* cpe:2.3:a:apache:struts:2.1.5:::::::* cpe:2.3:a:apache:struts:2.0.10:::::::* cpe:2.3:a:apache:struts:2.0.1:::::::* cpe:2.3:a:apache:struts:2.2.1:::::::* cpe:2.3:a:apache:struts:2.3.3:::::::* cpe:2.3:a:apache:struts:2.0.6:::::::* cpe:2.3:a:apache:struts:2.3.1.1:::::::* cpe:2.3:a:apache:struts:2.0.11.1:::::::* cpe:2.3:a:apache:struts:2.0.7:::::::* cpe:2.3:a:apache:struts:2.3.4.1:::::::* cpe:2.3:a:apache:struts:2.0.8:::::::* cpe:2.3:a:apache:struts:2.0.11:::::::* cpe:2.3:a:apache:struts:2.2.3.1:::::::*	cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.1:::::::* cpe:2.3:a:fujitsu:interstage_business_process_manager_analytics:12.1:::::::* cpe:2.3:h:fujitsu:primergy:-:::::::* cpe:2.3:h:fujitsu:gp-s:-:::::::* cpe:2.3:o:fujitsu:gp7000f_firmware:-:::::::* cpe:2.3:a:oracle:solaris:11:::::::* cpe:2.3:o:fujitsu:primepower_firmware:-:::::::* cpe:2.3:o:fujitsu:gp-s_firmware:-:::::::* cpe:2.3:o:fujitsu:sparc_firmware:-:::::::* cpe:2.3:o:redhat:enterprise_linux:::::::: cpe:2.3:o:fujitsu:primergy_firmware:-:::::::* cpe:2.3:o:microsoft:windows_server_2012:-:::::::* cpe:2.3:a:apache:archiva:1.2.2:::::::* cpe:2.3:a:apache:archiva:1.2:-:::::: cpe:2.3:o:fujitsu:gp5000_firmware:-:::::::* cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.2:::::::* cpe:2.3:h:fujitsu:gp7000f:-:::::::* cpe:2.3:a:fujitsu:interstage_business_process_manager_analytics:12.0:::::::* cpe:2.3:o:microsoft:windows_server_2003:-:::::::* cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.1.1:::::::* cpe:2.3:o:microsoft:windows_server_2008:-:::::::* cpe:2.3:h:fujitsu:gp5000:-:::::::* cpe:2.3:a:apache:struts:::::::: cpe:2.3:a:apache:archiva:::::::: cpe:2.3:h:fujitsu:sparc:-:::::::* cpe:2.3:h:fujitsu:primepower:-:::::::*
CVSS	v2 : ~~9.3~~ v3 : ~~unknown~~	v2 : 9.3 v3 : 9.8
CWE	~~CWE-20~~	CWE-74
First Time		Apache archiva Fujitsu gp7000f Fujitsu primergy Redhat Microsoft windows Server 2012 Redhat enterprise Linux Fujitsu gp-s Firmware Fujitsu sparc Firmware Microsoft windows Server 2008 Microsoft windows Server 2003 Oracle Oracle siebel Apps - E-billing Fujitsu Fujitsu primergy Firmware Fujitsu gp-s Fujitsu interstage Business Process Manager Analytics Oracle solaris Fujitsu gp7000f Firmware Fujitsu gp5000 Fujitsu sparc Fujitsu primepower Firmware Fujitsu gp5000 Firmware Microsoft Fujitsu primepower

9.8 /10