CVE-2013-2251

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

CVSS v3 9.8 CRITICAL
CVSS v2.0 9.3 HIGH

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.3^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://archiva.apache.org/security.html	Product
http://cxsecurity.com/issue/WLB-2014010087	Exploit Third Party Advisory
http://osvdb.org/98445	Broken Link
http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html	Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2013/Oct/96	Exploit Mailing List Third Party Advisory
http://seclists.org/oss-sec/2014/q1/89	Mailing List Third Party Advisory
http://struts.apache.org/release/2.3.x/docs/s2-016.html	Patch
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2	Third Party Advisory
http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html	Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html	Patch Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html	Patch Third Party Advisory
http://www.securityfocus.com/bid/61189	Broken Link Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/64758	Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1029184	Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1032916	Broken Link Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/90392	Third Party Advisory VDB Entry
http://archiva.apache.org/security.html	Product
http://cxsecurity.com/issue/WLB-2014010087	Exploit Third Party Advisory
http://osvdb.org/98445	Broken Link
http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html	Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2013/Oct/96	Exploit Mailing List Third Party Advisory
http://seclists.org/oss-sec/2014/q1/89	Mailing List Third Party Advisory
http://struts.apache.org/release/2.3.x/docs/s2-016.html	Patch
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2	Third Party Advisory
http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html	Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html	Patch Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html	Patch Third Party Advisory
http://www.securityfocus.com/bid/61189	Broken Link Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/64758	Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1029184	Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1032916	Broken Link Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/90392	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:archiva::::::::
	cpe:2.3:a:apache:archiva:1.2:-::::::
	cpe:2.3:a:apache:archiva:1.2.2:::::::*
	cpe:2.3:a:apache:struts::::::::

Configuration 2 (hide)

AND

cpe:2.3:a:fujitsu:interstage_business_process_manager_analytics:12.0:*:*:*:*:*:*:*

OR	cpe:2.3:o:microsoft:windows_server_2003:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2008:-:::::::*
	cpe:2.3:o:redhat:enterprise_linux::::::::

Configuration 3 (hide)

AND

cpe:2.3:a:fujitsu:interstage_business_process_manager_analytics:12.1:*:*:*:*:*:*:*

OR	cpe:2.3:o:microsoft:windows_server_2003:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2008:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
	cpe:2.3:o:oracle:solaris:11:::::::*
	cpe:2.3:o:redhat:enterprise_linux::::::::

Configuration 4 (hide)

AND

cpe:2.3:o:fujitsu:gp7000f_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:fujitsu:gp7000f:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:fujitsu:primepower_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:fujitsu:primepower:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND

cpe:2.3:o:fujitsu:gp-s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:fujitsu:gp-s:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND

cpe:2.3:o:fujitsu:primergy_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:fujitsu:primergy:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND

cpe:2.3:o:fujitsu:gp5000_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:fujitsu:gp5000:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND

cpe:2.3:o:fujitsu:sparc_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:fujitsu:sparc:-:*:*:*:*:*:*:*

Configuration 10 (hide)

OR	cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.1:::::::*
	cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.1.1:::::::*
	cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.2:::::::*

History

27 Nov 2024, 16:07

Type	Values Removed	Values Added
CPE	cpe:2.3:a:oracle:solaris:11:::::::*	cpe:2.3:o:oracle:solaris:11:::::::*

21 Nov 2024, 01:51

16 Jul 2024, 17:57

Information

Published : 2013-07-20 03:37

Updated : 2025-04-11 00:51

NVD link : CVE-2013-2251

Mitre link : CVE-2013-2251

CVE.ORG link : CVE-2013-2251

JSON object : View

Products Affected

fujitsu

primergy_firmware
sparc_firmware
gp5000
gp-s
primepower
gp7000f
primepower_firmware
primergy
sparc
gp7000f_firmware
gp5000_firmware
gp-s_firmware
interstage_business_process_manager_analytics

microsoft

windows_server_2012
windows_server_2003
windows_server_2008

apache

archiva
struts

redhat

enterprise_linux

oracle

solaris
siebel_apps_-_e-billing

CWE

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

{"id": "CVE-2013-2251", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2013-07-20T03:37:30.737", "references": [{"url": "http://archiva.apache.org/security.html", "tags": ["Product"], "source": "secalert@redhat.com"}, {"url": "http://cxsecurity.com/issue/WLB-2014010087", "tags": ["Exploit", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://osvdb.org/98445", "tags": ["Broken Link"], "source": "secalert@redhat.com"}, {"url": "http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "secalert@redhat.com"}, {"url": "http://seclists.org/fulldisclosure/2013/Oct/96", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://seclists.org/oss-sec/2014/q1/89", "tags": ["Mailing List", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://struts.apache.org/release/2.3.x/docs/s2-016.html", "tags": ["Patch"], "source": "secalert@redhat.com"}, {"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html", "tags": ["Patch", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html", "tags": ["Patch", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.securityfocus.com/bid/61189", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "secalert@redhat.com"}, {"url": "http://www.securityfocus.com/bid/64758", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "secalert@redhat.com"}, {"url": "http://www.securitytracker.com/id/1029184", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "secalert@redhat.com"}, {"url": "http://www.securitytracker.com/id/1032916", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "secalert@redhat.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90392", "tags": ["Third Party Advisory", "VDB Entry"], "source": "secalert@redhat.com"}, {"url": "http://archiva.apache.org/security.html", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://cxsecurity.com/issue/WLB-2014010087", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://osvdb.org/98445", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://seclists.org/fulldisclosure/2013/Oct/96", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://seclists.org/oss-sec/2014/q1/89", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://struts.apache.org/release/2.3.x/docs/s2-016.html", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/61189", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/64758", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1029184", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1032916", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90392", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-74"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-74"}]}], "descriptions": [{"lang": "en", "value": "Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix."}, {"lang": "es", "value": "Apache Struts v2.0.0 hasta v2.3.15 permite a atacantes remotos ejecutar expresiones OGNL arbitrarias mediante un par\u00e1metro con una (1)acci\u00f3n:, (2) redirect:, o (3) redirectAction:"}], "lastModified": "2025-04-11T00:51:21.963", "cisaActionDue": "2022-04-15", "cisaExploitAdd": "2022-03-25", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:archiva:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A10FB76-761D-4411-B6A8-B1AD5C133071", "versionEndExcluding": "1.3.8", "versionStartIncluding": "1.3"}, {"criteria": "cpe:2.3:a:apache:archiva:1.2:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0E0751C-E0BD-4C33-A541-C6FC67CE6663"}, {"criteria": "cpe:2.3:a:apache:archiva:1.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CCCF9A1C-7091-4D72-8AFC-5373F45FF7D5"}, {"criteria": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "61C63F76-5AFE-4D2F-B81C-D3476C165227", "versionEndIncluding": "2.3.15", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fujitsu:interstage_business_process_manager_analytics:12.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6D24308C-EEFB-477D-A88C-95E76CAC8AD7"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E3527F41-A6ED-437D-9833-458A2C60C2A3"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "32623D48-7000-4C7D-823F-7D2A9841D88C"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8D0C7AB6-1B62-49E3-99F8-53DD9329264E", "versionEndIncluding": "6.10", "versionStartIncluding": "5.0"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fujitsu:interstage_business_process_manager_analytics:12.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2825C5B3-6495-43FE-9D87-750C8B9B25EC"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E3527F41-A6ED-437D-9833-458A2C60C2A3"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "32623D48-7000-4C7D-823F-7D2A9841D88C"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074"}, {"criteria": "cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8E8C192B-8044-4BF9-9F1F-57371FC0E8FD"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8D0C7AB6-1B62-49E3-99F8-53DD9329264E", "versionEndIncluding": "6.10", "versionStartIncluding": "5.0"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fujitsu:gp7000f_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "577FACF4-0FB9-461A-877C-32DA8DBBF2B8"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:fujitsu:gp7000f:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D55A60A2-B9F8-49CF-AD55-033942363704"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fujitsu:primepower_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F5392609-A095-40AA-8190-783B8CCFDB18"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:fujitsu:primepower:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "77300584-CABF-4332-8E1A-763048496818"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fujitsu:gp-s_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "931139C5-A9D3-4D63-AF15-B0C5DD0578D1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:fujitsu:gp-s:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "855CDB9B-5476-4765-A8E3-69C7D42E1DFC"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fujitsu:primergy_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "78239AD8-F1E1-49F2-A89F-F8488F21C014"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:fujitsu:primergy:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6D9091D4-FC2B-43DE-A8C5-87922034536F"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fujitsu:gp5000_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "262CD533-5171-4AB0-9537-65FC5FBA195E"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:fujitsu:gp5000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0C3BE416-DA1B-4168-BE30-DFE3CD84E4E2"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fujitsu:sparc_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C3177688-5BBE-4C19-8A5C-FCF76AE2B227"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:fujitsu:sparc:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "80E1A333-794C-44BE-9E2A-C6711169681E"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "109A2A5D-D631-472F-AA80-2E1D707943F5"}, {"criteria": "cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51D5BAC9-E5B1-4A19-8B87-0CA2FA046D27"}, {"criteria": "cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F0DBE55-667B-45EF-8C3A-9C7AA33ADDE6"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com", "cisaRequiredAction": "Apply updates per vendor instructions.", "cisaVulnerabilityName": "Apache Struts Improper Input Validation Vulnerability"}

Type	Values Removed	Values Added
CWE	~~CWE-20~~	CWE-74
References	~~() http://archiva.apache.org/security.html -~~	() http://archiva.apache.org/security.html - Product
References	~~() http://cxsecurity.com/issue/WLB-2014010087 -~~	() http://cxsecurity.com/issue/WLB-2014010087 - Exploit, Third Party Advisory
References	~~() http://osvdb.org/98445 -~~	() http://osvdb.org/98445 - Broken Link
References	~~() http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html -~~	() http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry
References	~~() http://seclists.org/fulldisclosure/2013/Oct/96 -~~	() http://seclists.org/fulldisclosure/2013/Oct/96 - Exploit, Mailing List, Third Party Advisory
References	~~() http://seclists.org/oss-sec/2014/q1/89 -~~	() http://seclists.org/oss-sec/2014/q1/89 - Mailing List, Third Party Advisory
References	~~() http://struts.apache.org/release/2.3.x/docs/s2-016.html - Patch, Vendor Advisory~~	() http://struts.apache.org/release/2.3.x/docs/s2-016.html - Patch
References	~~() http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2 -~~	() http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2 - Third Party Advisory
References	~~() http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html -~~	() http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html - Third Party Advisory
References	~~() http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html -~~	() http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html - Patch, Third Party Advisory
References	~~() http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html - Patch, Vendor Advisory~~	() http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html - Patch, Third Party Advisory
References	~~() http://www.securityfocus.com/bid/61189 -~~	() http://www.securityfocus.com/bid/61189 - Broken Link, Third Party Advisory, VDB Entry
References	~~() http://www.securityfocus.com/bid/64758 -~~	() http://www.securityfocus.com/bid/64758 - Broken Link, Third Party Advisory, VDB Entry
References	~~() http://www.securitytracker.com/id/1029184 -~~	() http://www.securitytracker.com/id/1029184 - Broken Link, Third Party Advisory, VDB Entry
References	~~() http://www.securitytracker.com/id/1032916 -~~	() http://www.securitytracker.com/id/1032916 - Broken Link, Third Party Advisory, VDB Entry
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/90392 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/90392 - Third Party Advisory, VDB Entry
CPE	cpe:2.3:a:apache:struts:2.0.4:::::::* cpe:2.3:a:apache:struts:2.3.7:::::::* cpe:2.3:a:apache:struts:2.3.1.1:::::::* cpe:2.3:a:apache:struts:2.1.6:::::::* cpe:2.3:a:apache:struts:2.1.2:::::::* cpe:2.3:a:apache:struts:2.2.3:::::::* cpe:2.3:a:apache:struts:2.3.3:::::::* cpe:2.3:a:apache:struts:2.3.4.1:::::::* cpe:2.3:a:apache:struts:2.0.11.2:::::::* cpe:2.3:a:apache:struts:2.0.6:::::::* cpe:2.3:a:apache:struts:2.1.8:::::::* cpe:2.3:a:apache:struts:2.0.11.1:::::::* cpe:2.3:a:apache:struts:2.3.1.2:::::::* cpe:2.3:a:apache:struts:2.0.10:::::::* cpe:2.3:a:apache:struts:2.0.14:::::::* cpe:2.3:a:apache:struts:2.0.12:::::::* cpe:2.3:a:apache:struts:2.0.5:::::::* cpe:2.3:a:apache:struts:2.3.12:::::::* cpe:2.3:a:apache:struts:2.0.13:::::::* cpe:2.3:a:apache:struts:2.3.14:::::::* cpe:2.3:a:apache:struts:2.3.14.2:::::::* cpe:2.3:a:apache:struts:2.0.1:::::::* cpe:2.3:a:apache:struts:2.3.14.3:::::::* cpe:2.3:a:apache:struts:2.0.9:::::::* cpe:2.3:a:apache:struts:2.3.14.1:::::::* cpe:2.3:a:apache:struts:2.1.0:::::::* cpe:2.3:a:apache:struts:2.1.3:::::::* cpe:2.3:a:apache:struts:2.2.1.1:::::::* cpe:2.3:a:apache:struts:2.3.1:::::::* cpe:2.3:a:apache:struts:2.3.4:::::::* cpe:2.3:a:apache:struts:2.0.11:::::::* cpe:2.3:a:apache:struts:2.0.0:::::::* cpe:2.3:a:apache:struts:2.0.3:::::::* cpe:2.3:a:apache:struts:2.3.8:::::::* cpe:2.3:a:apache:struts:2.1.8.1:::::::* cpe:2.3:a:apache:struts:2.2.3.1:::::::* cpe:2.3:a:apache:struts:2.0.2:::::::* cpe:2.3:a:apache:struts:2.1.5:::::::* cpe:2.3:a:apache:struts:2.3.15:::::::* cpe:2.3:a:apache:struts:2.0.8:::::::* cpe:2.3:a:apache:struts:2.1.4:::::::* cpe:2.3:a:apache:struts:2.2.1:::::::* cpe:2.3:a:apache:struts:2.1.1:::::::* cpe:2.3:a:apache:struts:2.0.7:::::::*	cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.1.1:::::::* cpe:2.3:a:apache:archiva:::::::: cpe:2.3:h:fujitsu:primepower:-:::::::* cpe:2.3:o:fujitsu:gp-s_firmware:-:::::::* cpe:2.3:a:apache:struts:::::::: cpe:2.3:a:oracle:solaris:11:::::::* cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.2:::::::* cpe:2.3:a:fujitsu:interstage_business_process_manager_analytics:12.1:::::::* cpe:2.3:h:fujitsu:gp5000:-:::::::* cpe:2.3:h:fujitsu:sparc:-:::::::* cpe:2.3:o:fujitsu:primepower_firmware:-:::::::* cpe:2.3:a:apache:archiva:1.2.2:::::::* cpe:2.3:o:fujitsu:sparc_firmware:-:::::::* cpe:2.3:o:fujitsu:gp7000f_firmware:-:::::::* cpe:2.3:h:fujitsu:primergy:-:::::::* cpe:2.3:o:fujitsu:gp5000_firmware:-:::::::* cpe:2.3:a:apache:archiva:1.2:-:::::: cpe:2.3:o:microsoft:windows_server_2003:-:::::::* cpe:2.3:a:fujitsu:interstage_business_process_manager_analytics:12.0:::::::* cpe:2.3:h:fujitsu:gp7000f:-:::::::* cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.1:::::::* cpe:2.3:o:microsoft:windows_server_2008:-:::::::* cpe:2.3:o:fujitsu:primergy_firmware:-:::::::* cpe:2.3:o:redhat:enterprise_linux:::::::: cpe:2.3:o:microsoft:windows_server_2012:-:::::::* cpe:2.3:h:fujitsu:gp-s:-:::::::*
CVSS	v2 : ~~9.3~~ v3 : ~~unknown~~	v2 : 9.3 v3 : 9.8
First Time		Fujitsu primepower Oracle Redhat Microsoft windows Server 2012 Fujitsu primepower Firmware Fujitsu gp-s Oracle siebel Apps - E-billing Microsoft Oracle solaris Fujitsu gp7000f Fujitsu sparc Fujitsu gp-s Firmware Fujitsu sparc Firmware Fujitsu primergy Fujitsu primergy Firmware Fujitsu gp5000 Microsoft windows Server 2003 Fujitsu Fujitsu gp7000f Firmware Redhat enterprise Linux Fujitsu interstage Business Process Manager Analytics Microsoft windows Server 2008 Apache archiva Fujitsu gp5000 Firmware

9.8 /10