by Kastro
Paper/Archive/CVE-2012-0391

CVE-2012-0391

Apache Struts 2 — Apache Struts 2 Improper Input Validation Vulnerability

KEV · due 21 JulEPSS 76%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.5.995 × 2019.9Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

exploitexploit-db.com/exploits/18329refarchives.neohapsis.com/archives/bugtraq/2012-01/0031.htmlrefstruts.apache.org/2.x/docs/version-notes-2311.htmlrefstruts.apache.org/2.x/docs/s2-008.htmlrefsec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txtrefissues.apache.org/jira/browse/WW-3668writeupsecunia.com/advisories/47393refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0391kevcisa.gov/known-exploited-vulnerabilities-catalog