critical9.8Known exploitedPublic exploit code
CVE-2012-0391
Apache Struts 2 Improper Input Validation Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-01-21. Federal due date: 2022-07-21.
Apply updates per vendor instructions.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Apache Struts 2.2.1.1 - Remote Command Execution (Metasploit)2012-06-05 · remote · multiple · Verified
- Apache Struts 2 < 2.3.1 - Multiple Vulnerabilities2012-01-06 · webapps · multiple · Verified
Impact
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Struts | before 2.2.3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html
- http://secunia.com/advisories/47393
- http://struts.apache.org/2.x/docs/s2-008.html
- http://struts.apache.org/2.x/docs/version-notes-2311.html
- http://www.exploit-db.com/exploits/18329
- https://issues.apache.org/jira/browse/WW-3668
- https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt
- http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html
- http://secunia.com/advisories/47393
- http://struts.apache.org/2.x/docs/s2-008.html
- http://struts.apache.org/2.x/docs/version-notes-2311.html
- http://www.exploit-db.com/exploits/18329
- https://issues.apache.org/jira/browse/WW-3668
- https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0391