CVE-2013-2248: Open redirect in Apache Struts
Summary
CVE-2013-2248: Open redirect in Apache Struts. Affects org.apache.struts:struts2-core versions < 2.3.15.1. Fixed in 2.3.15.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and a MVC (Model-View-Controller) architecture for building scalable and maintainable web applications. The Struts 2 DefaultActionMapper is a component used for handling navigation state changes. It supports a method for short-circuit navigation by prefixing parameters with "redirect:" or "redirectAction:" followed by a desired redirect target expression. This feature was intended to attach navigational information to buttons within forms. However, in Struts 2 before version 2.3.15.1, this mechanism can be manipulated to redirect to arbitrary locations.
Vulnerability Detail
The vulnerability (CVE-2013-2248) in Apache Struts allows attackers to perform open redirects, which can be exploited for phishing attacks. By manipulating the information following "redirect:" or "redirectAction:", an attacker can redirect users to arbitrary websites, tricking them into revealing sensitive information or performing unintended actions. This vulnerability has a moderate severity rating and is classified under CWE-20 (Improper Input Validation).
How To Fix
Latest published version: 7.4.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.15.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the fix by upgrading to the patched version of Apache Struts.
Conclusion
The open redirect vulnerability in Apache Struts (CVE-2013-2248) allows attackers to redirect users to arbitrary websites, enabling phishing attacks. It is crucial to upgrade to the patched version of Apache Struts (2.3.15.1 or later) to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.apache.struts:struts2-core →
FAQ
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and a MVC architecture for building scalable and maintainable web applications.
The DefaultActionMapper is a component in Apache Struts used for handling navigation state changes. It supports a method for short-circuit navigation by prefixing parameters with "redirect:" or "redirectAction:" followed by a desired redirect target expression.
An open redirect vulnerability allows an attacker to redirect users to arbitrary websites. In the case of Apache Struts, this vulnerability can be exploited by manipulating the redirect target expression to redirect users to malicious sites for phishing attacks.
This vulnerability can be used by attackers to trick users into visiting malicious websites, potentially leading to the disclosure of sensitive information or the execution of unintended actions.
To fix this vulnerability, it is recommended to upgrade to Apache Struts version 2.3.15.1 or later. This version includes a fix that prevents the manipulation of redirect targets.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts2-core.
