What is CVE-2013-2251?

CVE-2013-2251 is a critical-severity vulnerability in Apache Archiva, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 9.8/10. Published 2013-07-20.

How severe is CVE-2013-2251?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2013-2251 known to be exploited?

Yes. CVE-2013-2251 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2022-03-25), indicating it is being actively exploited. 72 public proof-of-concept repositories are indexed.

Vulnerability in Apache Archiva

CVE-2013-2251

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

Published 2013-07-20 · last modified 2026-06-16.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 1.000 (100.0th percentile), scored 2026-07-05.

Very high probability of exploitation in the next 30 days — among the top 0.1% most-likely-to-be-exploited CVEs. 100th percentile — 100.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

The 30-day trend appears once there are two daily scores.

Affected products

Apache Archiva — versions 1.2, 1.2.2
Apache Struts
Fujitsu Interstage Business Process Manager Analytics — versions 12.0, 12.1
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2012
Oracle Siebel Apps - E-Billing — versions 6.1, 6.1.1, 6.2
Oracle Solaris — versions 11
Red Hat Enterprise Linux

Weakness classification (CWE)

CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

CISA KEV (Known Exploited Vulnerabilities)

This CVE is on the CISA KEV catalog, added on 2022-03-25. CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.

BOD 22-01 due date: 2022-04-15.

Required action: Apply updates per vendor instructions.

Public proof-of-concept exploits

References

www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-anal… (Third Party Advisory, Broken Link)
www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html (Patch, Third Party Advisory)
exchange.xforce.ibmcloud.com/vulnerabilities/90392 (VDB Entry, Third Party Advisory, vdb-entry)
seclists.org/fulldisclosure/2013/Oct/96 (mailing-list, Exploit, Mailing List, Third Party Advisory)
cxsecurity.com/issue/WLB-2014010087 (Exploit, Third Party Advisory)
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023… (vendor-advisory, Third Party Advisory)
struts.apache.org/release/2.3.x/docs/s2-016.html (Patch)
archiva.apache.org/security.html (Product)
osvdb.org/98445 (vdb-entry, Broken Link)
www.securitytracker.com/id/1032916 (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)

Frequently asked questions

What is CVE-2013-2251?: CVE-2013-2251 is a critical-severity vulnerability in Apache Archiva, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 9.8/10. Published 2013-07-20.
How severe is CVE-2013-2251?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2013-2251 known to be exploited?: Yes. CVE-2013-2251 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2022-03-25), indicating it is being actively exploited. 72 public proof-of-concept repositories are indexed.