CVE-2012-0391 Apache Struts Remote Java Code Execution
CriticalCVSS 9.8
EPSS 75.6%
CISA KEV
added 2022-01-21 · due 2022-07-21
Exploited in the wild
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
CISA Known Exploited Vulnerability
- Date added
- 2022-01-21
- Due date (FCEB)
- 2022-07-21
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.struts/struts2-core(Maven) | < 2.2.3.1 | 2.2.3.1 |
| org.apache.struts/struts2-core(Maven) | = 2.0.11 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.11.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.11.2 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.12 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.14 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.5 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.6 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.8 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.9 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.1.2 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.1.6 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.1.8 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.1.8.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.2.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.2.1.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.2.3 | No fix listed |
| org.apache.struts.xwork/xwork-core(Maven) | < 2.2.3.1 | 2.2.3.1 |
| org.apache.struts.xwork/xwork-core(Maven) | = 2.2.1 | No fix listed |
| org.apache.struts.xwork/xwork-core(Maven) | = 2.2.1.1 | No fix listed |
| org.apache.struts.xwork/xwork-core(Maven) | = 2.2.3 | No fix listed |
| apache struts | < 2.2.3.1 | 2.2.3.1 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com product
- issues.apache.org vendor-advisory
- www.cisa.gov government-resource us-government-resource
- www.sec-consult.com broken-link exploit
- 20120105 SEC Consult SA-20120104-0 :: Multiple critical vulnerabilities in Apache Struts2 broken-link exploit mailing-list
- 47393 third-party-advisory vendor-advisory
- struts.apache.org vendor-advisory
- struts.apache.org vendor-advisory
- 18329 exploit
- github.com