CVEvulnerability

CVE-2012-0391

9.8 CRITICAL Known exploited Published 2012-01-08 Modified 2026-06-16 Official page ↗

CISA Known Exploited Vulnerability

Apache Struts 2 Improper Input Validation Vulnerability — Apache Struts 2

The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.

Added to KEV: 2022-01-21
Remediation due: 2022-07-21
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2012-0391

Status: Analyzed
Published: 2012-01-08
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses: CWE-94

Description

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.

Affected configurations

• apache struts (< 2.2.3.1)

Weakness · CWE (1)

CWE-94 Improper Control of Generation of Code weakness

References