CVE-2013-4310

🗓️ 30 Sep 2013 21:00:00Reported by redhatType

cve🔗 web.nvd.nist.gov👁 80 Views🌐 WEB

Apache Struts 2.0.0 through 2.3.15.1 bypasses access controls with crafted actio

Reporter	Title	Published	Views	Family All 23
IBM Security Bulletins	Security Bulletin: IBM Storwize V7000 Unified V1.4.2.1 Includes Fixes for IBM Storwize V7000 Security Vulnerabilities (CVE-2013-4310 CVE-2013-4316)	26 Sep 202204:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Call Center and Apache Struts Struts upgrade strategy (various CVEs, see below)	14 Sep 202217:37	–	ibm
IBM Security Bulletins	Security Bulletin: Intelligent Clusters Security Bulletin, 1410	24 Jan 201912:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Platform Symphony (CVE-2013-2251 CVE-2013-2248 CVE-2013-2135 CVE-2013-2134 CVE-2013-2115 CVE-2013-1966 CVE-2013-1965 CVE-2013-4310)	18 Jun 201801:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Order Management Apache Struts upgrade strategy (various CVEs, see below)	14 Sep 202217:45	–	ibm
IBM Security Bulletins	Security Bulletin:Sterling Web Channel is affected by Apache Struts 2 security vulnerabilities (CVE-2013-4310, CVE-2013-4316, CVE-2013-2251, CVE-2013-2248, CVE-2013-2135, CVE-2013-2134, CVE-2013-2115, CVE-2013-1966, CVE-2013-1965)	16 Jun 201819:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SAN Volume Controller and Storwize Family security vulnerabilities (CVE-2013-4310 CVE-2013-4316)	29 Mar 202301:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Order Management and IBM Sterling Configure, Price, Quote are affected by multiple Apache Struts 2 security vulnerabilities.	16 Jun 201819:34	–	ibm
Cvelist	CVE-2013-4310	30 Sep 201321:00	–	cvelist
EUVD	EUVD-2022-4896	30 Sep 201321:00	–	euvd

NVD

Node

apache strutsMatch2.0.0

apache strutsMatch2.0.1

apache strutsMatch2.0.2

apache strutsMatch2.0.3

apache strutsMatch2.0.4

apache strutsMatch2.0.5

apache strutsMatch2.0.6

apache strutsMatch2.0.7

apache strutsMatch2.0.8

apache strutsMatch2.0.9

apache strutsMatch2.0.10

apache strutsMatch2.0.11

apache strutsMatch2.0.11.1

apache strutsMatch2.0.11.2

apache strutsMatch2.0.12

apache strutsMatch2.0.13

apache strutsMatch2.0.14

apache strutsMatch2.1.0

apache strutsMatch2.1.1

apache strutsMatch2.1.2

apache strutsMatch2.1.3

apache strutsMatch2.1.4

apache strutsMatch2.1.5

apache strutsMatch2.1.6

apache strutsMatch2.1.8

apache strutsMatch2.1.8.1

apache strutsMatch2.2.1

apache strutsMatch2.2.1.1

apache strutsMatch2.2.3

apache strutsMatch2.2.3.1

apache strutsMatch2.3.1

apache strutsMatch2.3.1.1

apache strutsMatch2.3.1.2

apache strutsMatch2.3.3

apache strutsMatch2.3.4

apache strutsMatch2.3.4.1

apache strutsMatch2.3.7

apache strutsMatch2.3.8

apache strutsMatch2.3.12

apache strutsMatch2.3.14

apache strutsMatch2.3.14.1

apache strutsMatch2.3.14.2

apache strutsMatch2.3.14.3

apache strutsMatch2.3.15

apache strutsMatch2.3.15.1

Source	Link
struts	www.struts.apache.org/release/2.3.x/docs/s2-018.html
secunia	www.secunia.com/advisories/54919
archives	www.archives.neohapsis.com/archives/bugtraq/2013-10/0083.html
oracle	www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
secunia	www.secunia.com/advisories/56492
secunia	www.secunia.com/advisories/56483
securitytracker	www.securitytracker.com/id/1029077
archives	www.archives.neohapsis.com/archives/bugtraq/2013-09/0107.html
securityfocus	www.securityfocus.com/bid/64758

Parameter	Position	Path	Description	CWE
action	query param	release/2.3.x/docs/s2-018.html	Apache Struts 2.0.0-2.3.15.1 allows remote attackers to bypass access controls via a crafted action prefix.	CWE-264

29 Apr 2026 01:13Current

7.7High risk

Vulners AI Score7.7

CVSS 25.8

EPSS0.08725

CWE-264