CVE-2013-2251: apache archiva +3 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2013-2251

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 100,0%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada apache archiva, apache struts +2 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 25 Maret 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

Rincian

Terbit di NVD: 20 Juli 2013
Terakhir diubah: 16 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
EPSS (30 hari): 100,0% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Apache Struts Improper Input Validation Vulnerability
Masuk KEV: 25 Maret 2022
Tenggat CISA: 15 April 2022 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
apache	archiva	Versi 1.3 hingga sebelum 1.3.8
apache	archiva	Versi 1.2
apache	archiva	Versi 1.2.2
apache	struts	Versi 2.0.0 hingga 2.3.15
fujitsu	interstage business process manager analytics	Versi 12.0
fujitsu	interstage business process manager analytics	Versi 12.1
oracle	siebel apps - e-billing	Versi 6.1
oracle	siebel apps - e-billing	Versi 6.1.1
oracle	siebel apps - e-billing	Versi 6.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://struts.apache.org/release/2.3.x/docs/s2-016.html patch
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html patch · advisory pihak ketiga
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html patch · advisory pihak ketiga
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2251 pemerintah AS
http://cxsecurity.com/issue/WLB-2014010087 exploit · advisory pihak ketiga
http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
http://seclists.org/fulldisclosure/2013/Oct/96 exploit · mailing list · advisory pihak ketiga
http://seclists.org/oss-sec/2014/q1/89 mailing list · advisory pihak ketiga
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2 advisory pihak ketiga
http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html broken link · advisory pihak ketiga
http://www.securityfocus.com/bid/61189 broken link · advisory pihak ketiga · vdb entry
http://www.securityfocus.com/bid/64758 broken link · advisory pihak ketiga · vdb entry
http://www.securitytracker.com/id/1029184 broken link · advisory pihak ketiga · vdb entry
http://www.securitytracker.com/id/1032916 broken link · advisory pihak ketiga · vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/90392 advisory pihak ketiga · vdb entry
http://archiva.apache.org/security.html product
http://osvdb.org/98445 broken link

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.