GitHub Advisoryadvisory · Maven

GHSA-2ppp-xj34-vvf7 Apache Struts's CookieInterceptor component does not use the parameter-name whitelist

MEDIUM Published 2022-05-04 Modified 2023-12-27 Official page ↗
Aliases
CVE-2012-0392
Ecosystem
Maven
Packages
org.apache.struts:struts2-core, org.apache.struts.xwork:xwork-core
Severity
Moderate
Reviewed
2023-12-27

Affected packages

• Maven org.apache.struts:struts2-core: < 2.2.3.1 → fixed in 2.2.3.1 • Maven org.apache.struts.xwork:xwork-core: < 2.2.3.1 → fixed in 2.2.3.1

Description

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.

Related

Alias · CVE (1)

  • CVE-2012-0392 The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to… vulnerability

References