CVE-2013-4310

Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix.

• CWE-264

• http://archives.neohapsis.com/archives/bugtraq/2013-09/0107.htmlPatch
• http://archives.neohapsis.com/archives/bugtraq/2013-10/0083.html
• http://secunia.com/advisories/54919Vendor Advisory
• http://secunia.com/advisories/56483
• http://secunia.com/advisories/56492
• http://struts.apache.org/release/2.3.x/docs/s2-018.htmlPatch, Vendor Advisory
• http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
• http://www.securityfocus.com/bid/64758
• http://www.securitytracker.com/id/1029077
• http://archives.neohapsis.com/archives/bugtraq/2013-09/0107.htmlPatch
• http://archives.neohapsis.com/archives/bugtraq/2013-10/0083.html
• http://secunia.com/advisories/54919Vendor Advisory
• http://secunia.com/advisories/56483
• http://secunia.com/advisories/56492
• http://struts.apache.org/release/2.3.x/docs/s2-018.htmlPatch, Vendor Advisory
• http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
• http://www.securityfocus.com/bid/64758
• http://www.securitytracker.com/id/1029077

Published

Sep 30, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-4304The CentralAuth extension for MediaWiki 1.19.x before 1.19.8…
• CVE-2013-4305Cross-site scripting (XSS) vulnerability in contrib/example.…
• CVE-2013-4306Cross-site request forgery (CSRF) vulnerability in api/ApiQu…
• CVE-2013-4307Multiple cross-site scripting (XSS) vulnerabilities in repo/…
• CVE-2013-4308Cross-site scripting (XSS) vulnerability in pages/TalkpageHi…
• CVE-2013-4309Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-4311libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, an…
• CVE-2013-4312The Linux kernel before 4.4.1 allows local users to bypass f…
• CVE-2013-4313Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.…
• CVE-2013-4314The X509Extension in pyOpenSSL before 0.13.1 does not proper…
• CVE-2013-4315Directory traversal vulnerability in Django 1.4.x before 1.4…
• CVE-2013-4316Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method …