← Zuruck zu CVEs

CVE-2012-0391

CRITICALCISA KEV

9.8

Beschreibung

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.

CVE Details

CVSS v3.1 Bewertung9.8

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht1/8/2012

Zuletzt geandert4/22/2026

Quellekev

Honeypot-Sichtungen0

CISA KEV

HerstellerApache

ProduktStruts 2

SchwachstellennameApache Struts 2 Improper Input Validation Vulnerability

KEV Aufnahmedatum2022-01-21

Behebungsfrist2022-07-21

Ransomware-NutzungUnknown

Betroffene Produkte

apache:struts

Schwachen (CWE)

CWE-94CWE-94

Referenzen

http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html(cve@mitre.org)

http://secunia.com/advisories/47393(cve@mitre.org)

http://struts.apache.org/2.x/docs/s2-008.html(cve@mitre.org)

http://struts.apache.org/2.x/docs/version-notes-2311.html(cve@mitre.org)

http://www.exploit-db.com/exploits/18329(cve@mitre.org)

https://issues.apache.org/jira/browse/WW-3668(cve@mitre.org)

https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt(cve@mitre.org)

http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html(af854a3a-2127-422b-91ae-364da2661108)

http://secunia.com/advisories/47393(af854a3a-2127-422b-91ae-364da2661108)

http://struts.apache.org/2.x/docs/s2-008.html(af854a3a-2127-422b-91ae-364da2661108)

http://struts.apache.org/2.x/docs/version-notes-2311.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.exploit-db.com/exploits/18329(af854a3a-2127-422b-91ae-364da2661108)

https://issues.apache.org/jira/browse/WW-3668(af854a3a-2127-422b-91ae-364da2661108)

https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0391(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.