Vulnerability CVE-2013-2251 - CERT Civis.Net

Vulnerability Name:

CVE-2013-2251 (CCN-85756)

Assigned:

2013-07-17

Published:

2013-07-17

Updated:

2020-10-20

Summary:

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
7.7 High (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
6.2 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:F/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: CONFIRM
Type: UNKNOWN
http://archiva.apache.org/security.html

Source: MITRE
Type: CNA
CVE-2013-2251

Source: MISC
Type: UNKNOWN
http://cxsecurity.com/issue/WLB-2014010087

Source: OSVDB
Type: UNKNOWN
98445

Source: MISC
Type: UNKNOWN
http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html

Source: FULLDISC
Type: UNKNOWN
20131013 Apache Software Foundation A Subsite Remote command execution

Source: MLIST
Type: UNKNOWN
[oss-security] 20140114 Re: CVE Request: Apache Archiva Remote Command Execution 0day

Source: CCN
Type: SA54118
Apache Struts DefaultActionMapper Redirection and OGNL Security Bypass Vulnerabilities

Source: CCN
Type: SA54189
Atlassian Bamboo Web Interface OGNL Code Injection Vulnerabilities

Source: CCN
Type: SA54192
FishEye / Crucible OGNL Code Injection Vulnerability

Source: CCN
Type: SA54283
Huawei Products Apache Struts 2 Multiple Vulnerabilities

Source: CCN
Type: SA54656
Interstage Business Process Manager Analytics Apache Struts 2 Multiple Vulnerabilities

Source: CCN
Type: SA55457
Cisco Media Experience Engine (MXE) 3500 Series Apache Struts Spoofing Vulnerability

Source: CCN
Type: SA55459
Cisco Business Edition 3000 Apache Struts OGNL Security Bypass Vulnerability

Source: CCN
Type: SA55467
Cisco Unified SIP Proxy (USP) Apache Struts OGNL Security Bypass Vulnerability

Source: CCN
Type: SA56325
Apache Archiva Struts OGNL Security Bypass Vulnerability

Source: CCN
Type: Apache Struts Security Bulletin S2-016
A vulnerability introduced by manipulating parameters prefixed with "action:"/"redirect:"/"redirectAction:" allows remote command execution

Source: CONFIRM
Type: Patch, Vendor Advisory
http://struts.apache.org/release/2.3.x/docs/s2-016.html

Source: CCN
Type: cisco-sa-20131023-struts2
Apache Struts 2 Command Execution Vulnerability in Multiple Cisco Products

Source: CISCO
Type: UNKNOWN
20131023 Apache Struts 2 Command Execution Vulnerability in Multiple Cisco Products

Source: CCN
Type: IBM Security Bulletin T1020112
IBM Platform Application Center (CVE-2013-2251 CVE-2013-2248 CVE-2013-2135 CVE-2013-2134 CVE-2013-2115 CVE-2013-1966 CVE-2013-1965 CVE-2013-4310)

Source: CCN
Type: IBM Security Bulletin T1020113
IBM Platform HPC (CVE-2013-2251 CVE-2013-2248 CVE-2013-2135 CVE-2013-2134 CVE-2013-2115 CVE-2013-1966 CVE-2013-1965 CVE-2013-4310)

Source: CCN
Type: IBM Security Bulletin T1020114
IBM Platform Cluster Manager Standard Edition (CVE-2013-2251 CVE-2013-2248 CVE-2013-2135 CVE-2013-2134 CVE-2013-2115 CVE-2013-1966 CVE-2013-1965 CVE-2013-4310)

Source: CCN
Type: IBM Security Bulletin T1020115
IBM Platform Cluster Manager Advanced Edition (CVE-2013-2251 CVE-2013-2248 CVE-2013-2135 CVE-2013-2134 CVE-2013-2115 CVE-2013-1966 CVE-2013-1965 CVE-2013-4310)

Source: CCN
Type: IBM Security Bulletin T1020512
IBM Platform Symphony (CVE-2013-2251 CVE-2013-2248 CVE-2013-2135 CVE-2013-2134 CVE-2013-2115 CVE-2013-1966 CVE-2013-1965 CVE-2013-4310)

Source: CCN
Type: IBM Security Bulletin S1004437
IBM Storwize V7000 Unified Update Includes Fixes for Multiple Vendor Security Vulnerabilities

Source: CCN
Type: IBM Security Bulletin S1004481
Unauthorized access exposure on IBM SAN Volume Controller and Storwize Family (CVE-2013-2251 CVE-2013-2248 CVE-2013-2135 CVE-2013-2134 CVE-2013-2115 CVE-2013-1966 CVE-2013-1965)

Source: CCN
Type: IBM Security Bulletin 1663496
IBM Sterling Order Management and IBM Sterling Configure, Price, Quote are affected by multiple Apache Struts 2 security vulnerabilities.

Source: CCN
Type: Fujitsu Web site
Security Fujitsu Patch & TA Information Oracle Solaris Patch & TA Information Interstage Business Process Manager Analytics: Vulnerability of arbitrary code Executing (CVE-2013-2248, CVE-2013-2251)

Source: CONFIRM
Type: UNKNOWN
http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html

Source: CCN
Type: Huawei-SA-20130730-Struts
Multiple Apache Struts 2 Vulnerabilities in Huawei Products

Source: CONFIRM
Type: UNKNOWN
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html

Source: CCN
Type: Oracle Critical Patch Update - July 2015
Oracle Critical Patch Update - July 2015

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

Source: CCN
Type: Oracle Web site
Oracle Critical Patch Update - October 2013

Source: CCN
Type: OSVDB ID: 98445
Apache Struts redirect Action Crafted Request Remote Command Execution

Source: BID
Type: UNKNOWN
61189

Source: CCN
Type: BID-61189
Apache Struts CVE-2013-2251 Multiple Remote Command Execution Vulnerabilities

Source: BID
Type: UNKNOWN
64758

Source: CCN
Type: BID-64758
RETIRED: Oracle January 2014 Critical Patch Update Multiple Vulnerabilities

Source: SECTRACK
Type: UNKNOWN
1029184

Source: SECTRACK
Type: UNKNOWN
1032916

Source: CCN
Type: Bamboo Security Advisory 2013-07-16
This advisory discloses a security vulnerability that we have found in Bamboo and fixed in a recent version of Bamboo.

Source: CCN
Type: FishEye and Crucible Security Advisory 2013-07-16
FishEye and Crucible

Source: XF
Type: UNKNOWN
apache-struts-cve20132251-command-exec(85756)

Source: XF
Type: UNKNOWN
apache-archiva-ognl-command-exec(90392)

Source: CCN
Type: Packet Storm Security [7-25-2013]
Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution

Source: CCN
Type: Packet Storm Security [08-13-2013]
Struts2 2.3.15 OGNL Injection

Source: CCN
Type: Packet Storm Security [10-20-2020]
Apache Struts 2 Remote Code Execution

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [07-27-2013]

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [10-20-2020]

Source: CCN
Type: IBM Security Bulletin 6620351 (Call Center for Commerce)
IBM Call Center and Apache Struts Struts upgrade strategy (various CVEs, see below)

Source: CCN
Type: IBM Security Bulletin 6620355 (Sterling Order Management)
IBM Sterling Order Management Apache Struts upgrade strategy (various CVEs, see below)

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2013-2251

Vulnerable Configuration:

Configuration 1:

cpe:/a:apache:struts:2.2.3.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.4:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.14.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.8:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.14:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.8.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.2.1.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.12:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.1.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.11.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.14.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.15:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.2.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.0:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.8:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.0:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.7:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.14:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.11:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.14.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.6:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.13:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.12:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.2.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.4:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.5:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.9:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.11.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.5:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.4:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.6:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.7:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.10:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.1.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.4.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.8:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:apache:struts:2.0.8:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.5:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.6:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.9:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.10:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.11:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.11.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.11.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.0:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.12:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.13:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.14:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.4:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.7:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.0:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.4:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.5:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.6:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.8:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.8.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.2.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.2.1.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.2.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.14.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.13:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.14:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.15:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.2.3.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.8:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.7:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.4.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.4:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.1.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.1.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.12:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.14.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.14.1:*:*:*:*:*:*:*

AND

cpe:/a:atlassian:fisheye:2.4.3:*:*:*:*:*:*:*

OR cpe:/a:atlassian:fisheye:2.3.1:*:*:*:*:*:*:*

OR cpe:/a:atlassian:crucible:2.4.3:*:*:*:*:*:*:*

OR cpe:/a:atlassian:crucible:2.2.3:*:*:*:*:*:*:*

OR cpe:/a:atlassian:fisheye:2.4.6:*:*:*:*:*:*:*

OR cpe:/a:atlassian:fisheye:2.5.0:*:*:*:*:*:*:*

OR cpe:/a:atlassian:crucible:2.4.6:*:*:*:*:*:*:*

OR cpe:/a:atlassian:crucible:2.5.0:*:*:*:*:*:*:*

OR cpe:/a:atlassian:crucible:2.5.1:*:*:*:*:*:*:*

OR cpe:/a:atlassian:fisheye:2.7.8:*:*:*:*:*:*:*

OR cpe:/a:atlassian:crucible:2.7.8:*:*:*:*:*:*:*

OR cpe:/a:atlassian:crucible:2.7.11:*:*:*:*:*:*:*

OR cpe:/a:atlassian:fisheye:2.7.11:*:*:*:*:*:*:*

OR cpe:/a:atlassian:bamboo:4.0:*:*:*:*:*:*:*

OR cpe:/o:ibm:san_volume_controller_firmware:6.1.0.0:*:*:*:*:*:*:*

OR cpe:/o:ibm:san_volume_controller_firmware:6.2.0.0:*:*:*:*:*:*:*

OR cpe:/o:ibm:san_volume_controller_firmware:6.3.0.0:*:*:*:*:*:*:*

OR cpe:/o:ibm:san_volume_controller_firmware:6.4.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.0:*:*:*:*:*:*:*

OR cpe:/o:ibm:storwize_v5000_firmware:7.1.0.0:*:*:*:*:*:*:*

OR cpe:/o:ibm:san_volume_controller_firmware:7.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:6.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:6.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:6.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.1:*:*:*:*:*:*:*

OR cpe:/o:ibm:storwize_v7000_firmware:7.1.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:platform_symphony:5.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:platform_symphony:6.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:sterling_selling_and_fulfillment_foundation:9.2.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:sterling_field_sales:9.0:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:com.ubuntu.precise:def:20132251000	V	CVE-2013-2251 on Ubuntu 12.04 LTS (precise) - medium.	2013-07-19