---
id: "CVE-2013-2251"
kind: "vulnerability"
aliases: ["CVE-2013-2251"]
title: "Apache Struts: Apache Struts Improper Input Validation Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.99998
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Apache Struts", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apache-struts", "exploited", "java", "runtime", "struts"]
not_affected_if: ["not-struts"]
published_at: "2013-07-20T03:37:30+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-2251", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2013-2251", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2251", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Apache Struts: Apache Struts Improper Input Validation Vulnerability

Apache Struts allows remote attackers to execute arbitrary OGNL expressions through crafted requests. An attacker can run code on the server hosting the Struts application.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apache Struts affected ? fixed ?

## Fix

Apply updates per vendor instructions; the specific fixed version is not stated in the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-2251
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2013-2251
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2013-2251

## From the sources

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_