CVE-2013-4310 Apache Struts2 Broken Access Control Vulnerability

What is CVE-2013-4310?

CVE-2013-4310 is a medium-severity authentication bypass vulnerability in Apache Struts, published on 30 Sep 2013. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix.

Weakness: CWE-264

Which versions are affected by CVE-2013-4310?

2 open source packages ship an affected version, including org.apache.struts:struts2-core. It affects 1 product.

Products include Apache Struts.

How do I fix CVE-2013-4310?

Upgrade org.apache.struts:struts2-core to 2.3.15.3 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2013-4310 being exploited?

There is no known exploitation of CVE-2013-4310 in the wild and no public exploit code.

Other vulnerabilities in Apache Struts

• CVE-2020-17530 Apache Struts Remote Code Execution Exploited Critical 9.8
• CVE-2017-9791 Apache Struts 1 Improper Input Validation Exploited Critical 9.8
• CVE-2017-5638 Apache Struts Remote Code Execution Exploited Critical 9.8
• CVE-2012-0391 Apache Struts 2 Improper Input Validation Exploited Critical 9.8
• CVE-2018-11776 Apache Struts Remote Code Execution Exploited High 8.1

All Apache Struts vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q5q8-jghf-3pm3.