NVD Vulnerability Detail

CVE-2013-2251

Summary	Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
Publication Date	July 20, 2013, 12:37 p.m.
Registration Date	Jan. 26, 2021, 3:38 p.m.
Last Update	Nov. 21, 2024, 10:51 a.m.

CVSS3.1 : CRITICAL
スコア	9.8
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	不要
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高

CVSS2.0 : HIGH
Score	9.3
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:apache:archiva:1.2.2:::::::*
cpe:2.3:a:apache:archiva:1.2:-::::::
cpe:2.3:a:apache:struts::::::::	2.0.0	2.3.15
cpe:2.3:a:apache:archiva::::::::	1.3			1.3.8

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:fujitsu:interstage_business_process_manager_analytics:12.0:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows_server_2003:-:::::::*
2	cpe:2.3:o:microsoft:windows_server_2008:-:::::::*
3	cpe:2.3:o:redhat:enterprise_linux::::::::

Configuration3		or higher	or less	more than	less than
cpe:2.3:a:fujitsu:interstage_business_process_manager_analytics:12.1:::::::*
execution environment
1	cpe:2.3:a:oracle:solaris:11:::::::*
2	cpe:2.3:o:microsoft:windows_server_2003:-:::::::*
3	cpe:2.3:o:microsoft:windows_server_2008:-:::::::*
4	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
5	cpe:2.3:o:redhat:enterprise_linux::::::::

Configuration4		or higher	or less	more than	less than
cpe:2.3:o:fujitsu:gp7000f_firmware:-:::::::*
execution environment
1	cpe:2.3:h:fujitsu:gp7000f:-:::::::*

Configuration5		or higher	or less	more than	less than
cpe:2.3:o:fujitsu:primepower_firmware:-:::::::*
execution environment
1	cpe:2.3:h:fujitsu:primepower:-:::::::*

Configuration6		or higher	or less	more than	less than
cpe:2.3:o:fujitsu:gp-s_firmware:-:::::::*
execution environment
1	cpe:2.3:h:fujitsu:gp-s:-:::::::*

Configuration7		or higher	or less	more than	less than
cpe:2.3:o:fujitsu:primergy_firmware:-:::::::*
execution environment
1	cpe:2.3:h:fujitsu:primergy:-:::::::*

Configuration8		or higher	or less	more than	less than
cpe:2.3:o:fujitsu:gp5000_firmware:-:::::::*
execution environment
1	cpe:2.3:h:fujitsu:gp5000:-:::::::*

Configuration9		or higher	or less	more than	less than
cpe:2.3:o:fujitsu:sparc_firmware:-:::::::*
execution environment
1	cpe:2.3:h:fujitsu:sparc:-:::::::*

Configuration10	or higher	or less	more than	less than
cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.1.1:::::::*
cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.2:::::::*
cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.1:::::::*

Related information, measures and tools

No	URL	タグ
1	http://archiva.apache.org/security.html	Product
2	http://archiva.apache.org/security.html	Product
3	http://cxsecurity.com/issue/WLB-2014010087	Exploit Third Party Advisory
4	http://cxsecurity.com/issue/WLB-2014010087	Exploit Third Party Advisory
5	http://osvdb.org/98445	Broken Link
6	http://osvdb.org/98445	Broken Link
7	http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html	Exploit Third Party Advisory VDB Entry
8	http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html	Exploit Third Party Advisory VDB Entry
9	http://seclists.org/fulldisclosure/2013/Oct/96	Exploit Mailing List Third Party Advisory
10	http://seclists.org/fulldisclosure/2013/Oct/96	Exploit Mailing List Third Party Advisory
11	http://seclists.org/oss-sec/2014/q1/89	Mailing List Third Party Advisory
12	http://seclists.org/oss-sec/2014/q1/89	Mailing List Third Party Advisory
13	http://struts.apache.org/release/2.3.x/docs/s2-016.html	Patch
14	http://struts.apache.org/release/2.3.x/docs/s2-016.html	Patch
15	http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2	Third Party Advisory
16	http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2	Third Party Advisory
17	http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html	Third Party Advisory
18	http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html	Third Party Advisory
19	http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html	Patch Third Party Advisory
20	http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html	Patch Third Party Advisory
21	http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html	Patch Third Party Advisory
22	http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html	Patch Third Party Advisory
23	http://www.securityfocus.com/bid/61189	Broken Link Third Party Advisory VDB Entry
24	http://www.securityfocus.com/bid/61189	Broken Link Third Party Advisory VDB Entry
25	http://www.securityfocus.com/bid/64758	Broken Link Third Party Advisory VDB Entry
26	http://www.securityfocus.com/bid/64758	Broken Link Third Party Advisory VDB Entry
27	http://www.securitytracker.com/id/1029184	Broken Link Third Party Advisory VDB Entry
28	http://www.securitytracker.com/id/1029184	Broken Link Third Party Advisory VDB Entry
29	http://www.securitytracker.com/id/1032916	Broken Link Third Party Advisory VDB Entry
30	http://www.securitytracker.com/id/1032916	Broken Link Third Party Advisory VDB Entry
31	https://exchange.xforce.ibmcloud.com/vulnerabilities/90392	Third Party Advisory VDB Entry
32	https://exchange.xforce.ibmcloud.com/vulnerabilities/90392	Third Party Advisory VDB Entry

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-74	インジェクション	https://cwe.mitre.org/data/definitions/74.html

JVN Vulnerability Information

Apache Struts において任意のコマンドを実行される脆弱性

Title	Apache Struts において任意のコマンドを実行される脆弱性
Summary	Apache Struts には、任意のコマンドを実行される脆弱性が存在します。 Apache Software Foundation が提供する Apache Struts は、Java のウェブアプリケーションを作成するためのソフトウェアフレームワークです。Apache Struts には、任意のコマンドを実行される脆弱性が存在します。本件は、7月16日に開発者が公開した S2-016 の脆弱性と同じものです。なお、本脆弱性を使用した攻撃活動が確認されています。この脆弱性情報は、情報セキュリティ早期警戒パートナーシップに基づき下記の方が IPA に報告し、JPCERT/CC が開発者との調整を行いました。報告者: 三井物産セキュアディレクション株式会社寺田健氏
Possible impacts	Apache Struts が設置されているサーバ上で任意のコマンドを実行される可能性があります。
Solution	[アップデートする] 開発者が提供する情報をもとに最新版へアップデートしてください。
Publication Date	July 9, 2013, midnight
Registration Date	July 23, 2013, 2:04 p.m.
Last Update	Aug. 11, 2015, 3:15 p.m.

Affected System

Apache Software Foundation

Apache Struts 2.0.0 から 2.3.15 まで

オラクル

MySQL Enterprise Monitor 2.3.13 およびそれ以前

Oracle Financial Services Software の Oracle FLEXCUBE Private Banking 1.7

Oracle Financial Services Software の Oracle FLEXCUBE Private Banking 12.0.1

Oracle Financial Services Software の Oracle FLEXCUBE Private Banking 2.0

Oracle Financial Services Software の Oracle FLEXCUBE Private Banking 2.0.1

Oracle Financial Services Software の Oracle FLEXCUBE Private Banking 2.2.0.1

Oracle Financial Services Software の Oracle FLEXCUBE Private Banking 3.0

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Apache Software Foundation
1	CVE-2013-2251: Apache Archiva Remote Command Execution	http://archiva.apache.org/security.html
Common Vulnerabilities and Exposures (CVE)
2	CVE-2013-2251	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2251
National Vulnerability Database (NVD)
3	CVE-2013-2251	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2251

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-94	https://jvndb.jvn.jp/ja/cwe/CWE-94.html

ベンダー情報

No	Name	URL
Apache Software Foundation
1	S2-016	http://struts.apache.org/release/2.3.x/docs/s2-016.html
2	Struts 2.3.15.1	http://struts.apache.org/download.cgi#struts23151
Cisco Security Advisory
3	cisco-sa-20131023-struts2	http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2
IBM Support Document
4	1667890	http://www-01.ibm.com/support/docview.wss?uid=swg21667890
IBM セキュリティー情報
5	1670064	http://www-01.ibm.com/support/docview.wss?uid=swg21670064
Oracle Critical Patch Update
6	Oracle Critical Patch Update Advisory - July 2015	http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
7	Oracle Critical Patch Update Advisory - October 2013	http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
8	Text Form of Oracle Critical Patch Update - July 2015 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpujul2015verbose-2367947.html
9	Text Form of Oracle Critical Patch Update - October 2013 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpuoct2013verbose-1899842.html
SECURITY BLOG
10	July 2015 Critical Patch Update Released	https://blogs.oracle.com/security/entry/july_2015_critical_patch_update
11	October 2013 Critical Patch Update Released	https://blogs.oracle.com/security/entry/october_2013_critical_patch_update
Vulnerability Alert
12	30128	http://tools.cisco.com/security/center/viewAlert.x?alertId=30128
シスコセキュリティアドバイザリ
13	cisco-sa-20131023-struts2	http://www.cisco.com/cisco/web/support/JP/112/1120/1120773_cisco-sa-20131023-struts2-j.html
富士通セキュリティ情報
14	Interstage Business Process Manager Analytics: 任意のコード実行の脆弱性(CVE-2013-2248, CVE-2013-2251) (2013年9月4日)	http://software.fujitsu.com/jp/security/products-fujitsu/solution/interstage_bpm_analytics_201301.html

その他

No	Name	URL
JPCERT 注意喚起
1	JPCERT-AT-2013-0033	https://www.jpcert.or.jp/at/2013/at130033.html
JVN
2	JVN#33504150	http://jvn.jp/jp/JVN33504150/index.html

Change Log

No	Changed Details	Date of change
0	[2013年07月23日] 掲載 [2013年07月30日] CVSS による深刻度：内容を更新 [2013年09月06日] JVN#33504150 にあわせ、タイトル、概要、想定される影響、対策を更新 CVSS、CWE を IPA 値に変更影響を受けるシステム：内容を更新ベンダ情報：富士通 (Interstage Business Process Manager Analytics: 任意のコード実行の脆弱性(CVE-2013-2248, CVE-2013-2251) (2013年9月4日)) を追加 [2013年10月23日] 影響を受けるシステム：オラクル (Oracle Critical Patch Update Advisory - October 2013) の情報を追加ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - October 2013) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - October 2013 Risk Matrices) を追加ベンダ情報：オラクル (October 2013 Critical Patch Update Released) を追加 [2013年11月12日] ベンダ情報：シスコシステムズ (cisco-sa-20131023-struts2) を追加ベンダ情報：シスコシステムズ (30128) を追加 [2014年06月26日] ベンダ情報：IBM (1670064) を追加ベンダ情報：IBM (1667890) を追加 [2015年07月29日] ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - July 2015) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - July 2015 Risk Matrices) を追加ベンダ情報：オラクル (July 2015 Critical Patch Update Released) を追加 [2015年08月11日] ベンダ情報：Apache Software Foundation (CVE-2013-2251: Apache Archiva Remote Command Execution) を追加	Feb. 17, 2018, 10:37 a.m.