Skip to content

CVE-2011-3923 Struts ParameterInterceptor vulnerability allows remote command execution

CriticalCVSS 9.8 EPSS 89.5% Framework module Public exploit
Published
Updated
Exploit status
Public exploit available
Sign in for asset impact Search another CVE

Description

Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.

Affected products

ProductAffected versionsFixed in
org.apache.struts/struts2-core(Maven) >= 2.0.0, < 2.3.1.2 2.3.1.2
org.apache.struts/struts2-core(Maven) = 2.0.11 No fix listed
org.apache.struts/struts2-core(Maven) = 2.0.11.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.0.11.2 No fix listed
org.apache.struts/struts2-core(Maven) = 2.0.12 No fix listed
org.apache.struts/struts2-core(Maven) = 2.0.14 No fix listed
org.apache.struts/struts2-core(Maven) = 2.0.5 No fix listed
org.apache.struts/struts2-core(Maven) = 2.0.6 No fix listed
org.apache.struts/struts2-core(Maven) = 2.0.8 No fix listed
org.apache.struts/struts2-core(Maven) = 2.0.9 No fix listed
org.apache.struts/struts2-core(Maven) = 2.1.2 No fix listed
org.apache.struts/struts2-core(Maven) = 2.1.6 No fix listed
org.apache.struts/struts2-core(Maven) = 2.1.8 No fix listed
org.apache.struts/struts2-core(Maven) = 2.1.8.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.2.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.2.1.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.2.3 No fix listed
org.apache.struts/struts2-core(Maven) = 2.2.3.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.1.1 No fix listed
apache struts >= 2.0.0, < 2.3.1.2 2.3.1.2
redhat jboss enterprise web server = 1.0.0 No fix listed
apache struts = 2.3.1.2 No fix listed

References