GitHub Advisoryadvisory · Maven
GHSA-4wrr-9h5r-m92w Apache Struts Remote Java Code Execution
CRITICAL
Official page ↗
- Aliases
- CVE-2012-0391
- Ecosystem
- Maven
- Packages
- org.apache.struts:struts2-core, org.apache.struts.xwork:xwork-core
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-20, CWE-94
- Reviewed
- 2023-08-29
Affected packages
• Maven org.apache.struts:struts2-core: < 2.2.3.1 → fixed in 2.2.3.1
• Maven org.apache.struts.xwork:xwork-core: < 2.2.3.1 → fixed in 2.2.3.1
Description
The `ExceptionDelegator` component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
Related
Alias · CVE (1)
- CVE-2012-0391 The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2012-0391 advisory
- https://github.com/apache/struts/commit/25e50069d60434a30395e3a98357ffba2bed427e web
- https://github.com/apache/struts/commit/5f54b8d087f5125d96838aafa5f64c2190e6885b web
- https://github.com/apache/struts/commit/b4265d369dc29d57a9f2846a85b26598e83f3892 web
- https://github.com/apache/struts package
- https://issues.apache.org/jira/browse/WW-3668 web
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0391 web
- https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt web
- http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html web
- http://secunia.com/advisories/47393 web
- http://struts.apache.org/2.x/docs/s2-008.html web
- http://struts.apache.org/2.x/docs/version-notes-2311.html web
- http://www.exploit-db.com/exploits/18329 web