CVE-2013-2248: Input Validation
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.
Other sources
The Struts 2 DefaultActionMapper used to support a method for short-circuit navigation state changes by prefixing parameters with "redirect:" or "redirectAction:", followed by a desired redirect target expression. This mechanism was intended to help with attaching navigational information to buttons within forms. Attackers could use this to redirect to arbitrary web sites and conduct phishing attacks.
In Struts 2 before 2.3.15.1 the information following "redirect:" or "redirectAction:" can easily be manipulated to redirect to an arbitrary location.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2248?
CVE-2013-2248 has been classified with a high severity level due to its potential for remote exploitation.
How do I fix CVE-2013-2248?
To fix CVE-2013-2248, upgrade Apache Struts to version 2.3.15.1 or later.
What are the affected versions for CVE-2013-2248?
CVE-2013-2248 affects Apache Struts versions from 2.0.0 through 2.3.15.
What is the nature of the vulnerability described in CVE-2013-2248?
CVE-2013-2248 involves multiple open redirect vulnerabilities allowing attackers to redirect users to arbitrary websites.
Is there a workaround for CVE-2013-2248 before applying a patch?
The best practice is to immediately upgrade to a patched version, as there are no effective workarounds for CVE-2013-2248.