peter bassill · operator
$ cve CVE-2012-0391 JSON

CVE-2012-0391 KEV EXPLOIT

9.8
CRITICAL · CVSS 3.1 · EPSS 75.6% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-07-21.

Description

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS75.6% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-94
On CISA KEVyes — remediate by 2022-07-21
Public exploityes
Published2012-01-08
Last modified2026-06-16

CISA KEV

NameApache Struts 2 Improper Input Validation Vulnerability
Added2022-01-21
Due2022-07-21
Vendor / productApache / Struts 2
Ransomware usenone reported

Affected (1)

VendorProduct
apachestruts

Public exploits

SourceTitleDate
exploit-dbApache Struts 2.2.1.1 - Remote Command Execution (Metasploit)2012-06-05
exploit-dbApache Struts 2 < 2.3.1 - Multiple Vulnerabilities2012-01-06

References

→ the Explorer  ·  watch your stack  ·  NVD