Vulnerability record · CVE-2013-2248 · published 20 July 2013
CVE-2013-2248: Apache Struts 2 open redirect via redirect and redirectAction prefixes
Apache · Struts
Apache Struts 2.0.0 through 2.3.15 contains multiple open redirect flaws. A parameter value using the redirect: or redirectAction: prefix is not properly validated, so the application can be made to send users to an arbitrary external site. This matters because it enables credible phishing that abuses the trust of the legitimate domain.
Description
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.
AV:N/AC:M/Au:N/C:P/I:P/A:N
Automated analysis
medium priorityThe flaw is an unauthenticated network-reachable open redirect with very high EPSS, but it requires user interaction and yields only partial confidentiality and integrity impact.
What it is
Apache Struts 2.0.0 through 2.3.15 contains multiple open redirect flaws. A parameter value using the redirect: or redirectAction: prefix is not properly validated, so the application can be made to send users to an arbitrary external site. This matters because it enables credible phishing that abuses the trust of the legitimate domain.
Impact
An attacker can redirect victims from a trusted application URL to an attacker-controlled site, supporting phishing and credential theft. The CVSS 2.0 vector shows partial confidentiality and integrity impact with no availability impact.
Attack surface
Reachable over the network through crafted URLs containing a redirect: or redirectAction: prefixed parameter; no authentication is required per the CVSS vector (Au:N). Some user interaction is implied by AC:M, since a victim must follow the crafted link.
Exploitation
Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is very high (0.94654 probability, 99.852 percentile), indicating elevated likelihood of exploitation activity.
What to do
- Upgrade Apache Struts to a version later than 2.3.15, following the vendor S2-017 advisory.
- If immediate upgrade is not possible, restrict or block user-supplied parameters that begin with redirect: or redirectAction:.
- Validate and allowlist redirect destinations rather than accepting arbitrary URLs from request parameters.
- Review dependent products (for example Oracle and Fujitsu components listed in references) for their own Struts updates.
Detection
- Search web and proxy logs for requests containing redirect: or redirectAction: in parameter values.
- Alert on outbound redirects from application endpoints to external domains not on an approved allowlist.
- Monitor for phishing reports or referrer chains that originate from the affected application's redirect endpoints.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2013-2248 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2013-2248), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
