Apache · Struts
CVE-2013-2251
Apache Struts Improper Input Validation Vulnerability
공격에 악용됨
치명적 9.8 공격 가능성: >99.9%
무엇인가
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
CISA: Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions.
할 일
Apply updates per vendor instructions.
미국 연방 기관 조치 기한: 2022년 4월 15일
- CISA 목록에 추가됨
- 2022년 3월 25일
- 게시됨
- 2013년 7월 18일
- 심각도
- 치명적 9.8 CVSS 3.1
- 향후 30일 내 공격 가능성(EPSS)
- >99.9% 알려진 모든 취약점 중 상위 0.1%
- 약점 유형
- CWE-20
- 자세히
- NVD · CVE.org · CISA
모든 참고 자료(16)
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2
- http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90392
- http://seclists.org/fulldisclosure/2013/Oct/96
- http://cxsecurity.com/issue/WLB-2014010087
- http://struts.apache.org/release/2.3.x/docs/s2-016.html
- http://archiva.apache.org/security.html
- http://osvdb.org/98445
- http://www.securitytracker.com/id/1032916
- http://www.securityfocus.com/bid/61189
- http://www.securitytracker.com/id/1029184
- http://www.securityfocus.com/bid/64758
- http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- http://seclists.org/oss-sec/2014/q1/89
- http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html
Apache의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2026. 10. 8. | Command Injection | Struts | 높음 8.1 | 97% |
| 2021. 11. 3. | Remote Code Execution | Struts | 치명적 9.8 | >99.9% |
| 2021. 11. 3. | Deserialization of Untrusted Data | Struts | 높음 8.1 | 99.4% |
| 2021. 11. 3. | Remote Code Execution | Struts | 높음 8.1 | >99.9% |
| 2021. 11. 3. | Remote Code Execution | Struts | 치명적 9.8 | 96% |
| 2026. 8. 4. | Missing Encryption of Sensitive Data | Tomcat | 높음 7.5 | 99% |
| 2026. 4. 16. | Improper Input Validation | ActiveMQ | 높음 8.8 | 98% |
| 2025. 5. 1. | Improper Escaping of Output | HTTP Server | 치명적 9.1 | >99.9% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.