ByteOS Network

Vulnerability Details :

CVE-2012-0391

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-08 Jan, 2012 | 15:00

Updated At-30 Jul, 2025 | 01:47

Apache Struts 2 Improper Input Validation Vulnerability

The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Known Exploited Vulnerabilities (KEV)

cisa.gov

Vendor:

The Apache Software Foundation

Product:Struts 2

Added At:21 Jan, 2022

Due At:21 Jul, 2022

Apache Struts 2 Improper Input Validation Vulnerability

The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.

Used in Ransomware

Unknown

CWE

CWE-20

Required Action:

Apply updates per vendor instructions.

Additional Notes:

https://nvd.nist.gov/vuln/detail/CVE-2012-0391

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:08 Jan, 2012 | 15:00

Updated At:30 Jul, 2025 | 01:47

▼CVE Numbering Authority (CNA)

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
http://www.exploit-db.com/exploits/18329	exploit x_refsource_EXPLOIT-DB
http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html	mailing-list x_refsource_BUGTRAQ
http://struts.apache.org/2.x/docs/version-notes-2311.html	x_refsource_CONFIRM
http://struts.apache.org/2.x/docs/s2-008.html	x_refsource_CONFIRM
https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt	x_refsource_MISC
https://issues.apache.org/jira/browse/WW-3668	x_refsource_CONFIRM
http://secunia.com/advisories/47393	third-party-advisory x_refsource_SECUNIA

Hyperlink: http://www.exploit-db.com/exploits/18329

Resource:

exploit

x_refsource_EXPLOIT-DB

Hyperlink: http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html

Resource:

mailing-list

x_refsource_BUGTRAQ

Hyperlink: http://struts.apache.org/2.x/docs/version-notes-2311.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://struts.apache.org/2.x/docs/s2-008.html

Resource:

x_refsource_CONFIRM

Hyperlink: https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt

Resource:

x_refsource_MISC

Hyperlink: https://issues.apache.org/jira/browse/WW-3668

Resource:

x_refsource_CONFIRM

Hyperlink: http://secunia.com/advisories/47393

Resource:

third-party-advisory

x_refsource_SECUNIA

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
http://www.exploit-db.com/exploits/18329	exploit x_refsource_EXPLOIT-DB x_transferred
http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html	mailing-list x_refsource_BUGTRAQ x_transferred
http://struts.apache.org/2.x/docs/version-notes-2311.html	x_refsource_CONFIRM x_transferred
http://struts.apache.org/2.x/docs/s2-008.html	x_refsource_CONFIRM x_transferred
https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt	x_refsource_MISC x_transferred
https://issues.apache.org/jira/browse/WW-3668	x_refsource_CONFIRM x_transferred
http://secunia.com/advisories/47393	third-party-advisory x_refsource_SECUNIA x_transferred

Hyperlink: http://www.exploit-db.com/exploits/18329

Resource:

exploit

x_refsource_EXPLOIT-DB

x_transferred

Hyperlink: http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html

Resource:

mailing-list

x_refsource_BUGTRAQ

x_transferred

Hyperlink: http://struts.apache.org/2.x/docs/version-notes-2311.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://struts.apache.org/2.x/docs/s2-008.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://issues.apache.org/jira/browse/WW-3668

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://secunia.com/advisories/47393

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-94	CWE-94 Improper Control of Generation of Code ('Code Injection')

Type: CWE

CWE ID: CWE-94

Description: CWE-94 Improper Control of Generation of Code ('Code Injection')

Metrics

Version	Base score	Base severity	Vector
3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Metrics Other Info

kev

dateAdded:

2022-01-21

reference:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0391

Timeline

Event	Date
CVE-2012-0391 added to CISA KEV	2022-01-21 00:00:00

Event: CVE-2012-0391 added to CISA KEV

Date: 2022-01-21 00:00:00

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:08 Jan, 2012 | 15:55

Updated At:11 Apr, 2025 | 00:51

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2022-01-21	2022-07-21	Apache Struts 2 Improper Input Validation Vulnerability	Apply updates per vendor instructions.

Date Added: 2022-01-21

Due Date: 2022-07-21

Vulnerability Name: Apache Struts 2 Improper Input Validation Vulnerability

Required Action: Apply updates per vendor instructions.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C

Type: Secondary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 9.3

Base severity: HIGH

Vector:

AV:N/AC:M/Au:N/C:C/I:C/A:C

CPE Matches

The Apache Software Foundation

>>struts>>Versions before 2.2.3.1(exclusive)

cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-20	Primary	nvd@nist.gov
CWE-94	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-20

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-94

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html	cve@mitre.org	Exploit Broken Link
http://secunia.com/advisories/47393	cve@mitre.org	Vendor Advisory
http://struts.apache.org/2.x/docs/s2-008.html	cve@mitre.org	Vendor Advisory
http://struts.apache.org/2.x/docs/version-notes-2311.html	cve@mitre.org	Vendor Advisory
http://www.exploit-db.com/exploits/18329	cve@mitre.org	Exploit
https://issues.apache.org/jira/browse/WW-3668	cve@mitre.org	Vendor Advisory
https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt	cve@mitre.org	Exploit Broken Link
http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html	af854a3a-2127-422b-91ae-364da2661108	Exploit Broken Link
http://secunia.com/advisories/47393	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
http://struts.apache.org/2.x/docs/s2-008.html	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
http://struts.apache.org/2.x/docs/version-notes-2311.html	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
http://www.exploit-db.com/exploits/18329	af854a3a-2127-422b-91ae-364da2661108	Exploit
https://issues.apache.org/jira/browse/WW-3668	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt	af854a3a-2127-422b-91ae-364da2661108	Exploit Broken Link

Hyperlink: http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html

Source: cve@mitre.org

Resource:

Exploit

Broken Link

Hyperlink: http://secunia.com/advisories/47393

Source: cve@mitre.org

Resource:

Vendor Advisory

Hyperlink: http://struts.apache.org/2.x/docs/s2-008.html

Source: cve@mitre.org

Resource:

Vendor Advisory

Hyperlink: http://struts.apache.org/2.x/docs/version-notes-2311.html

Source: cve@mitre.org

Resource:

Vendor Advisory

Hyperlink: http://www.exploit-db.com/exploits/18329

Source: cve@mitre.org

Resource:

Exploit

Hyperlink: https://issues.apache.org/jira/browse/WW-3668

Source: cve@mitre.org

Resource:

Vendor Advisory

Hyperlink: https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt

Source: cve@mitre.org

Resource:

Exploit

Broken Link

Hyperlink: http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html