CVE-2013-2134: Apache Struts 2 OGNL code injection via crafted action name

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution in a widely used framework with a very high EPSS score warrants critical priority despite the absence of KEV listing.

What it is

Apache Struts 2 before 2.3.14.3 fails to properly handle a crafted action name during wildcard matching, allowing remote attackers to inject and execute arbitrary OGNL code. This is a distinct issue from CVE-2013-2135. Because it enables remote code execution on a widely deployed web framework, it is a serious risk to unpatched Struts 2 applications.

Impact

An unauthenticated remote attacker can execute arbitrary code in the context of the application server, leading to full compromise of the host and any data it can reach.

Attack surface

Reached over the network via an HTTP request containing a crafted action name; the CVSS vector (AV:N/AC:M/Au:N) indicates no authentication is required, though some conditions must be met for successful exploitation. No user interaction is indicated.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high (0.70211, 99.3rd percentile), indicating strong likelihood of exploitation activity. References are vendor and third-party advisories only, with no public exploit tag in the record.

What to do

• Upgrade Apache Struts 2 to 2.3.14.3 or later as the primary fix.
• If immediate upgrade is not possible, apply the vendor's S2-015 guidance and restrict or sanitize wildcard action name handling.
• Deploy a WAF or reverse proxy rule to block requests with suspicious OGNL expressions in action names.
• Remove or disable unused Struts 2 applications and endpoints exposed to untrusted networks.
• Monitor vendor and third-party advisories for updated guidance on affected deployments.

Detection

• Inspect web and proxy logs for requests with unusual or OGNL-like characters in action name paths.
• Alert on unexpected child processes or command execution spawned by the Java application server.
• Monitor for outbound connections from the application server to unusual destinations that could indicate post-exploitation activity.
• Review application server error logs for Struts wildcard matching or OGNL parsing exceptions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.