CVE-2012-0391: Apache Struts 2 Improper Input Validation Vulnerability
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
Other sources
The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.
— CISA
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.struts.xwork:xwork-coreto a version that resolves this vulnerability.Fixed in 2.2.3.1 - Upgrade
Upgrade
maven/org.apache.struts:struts2-coreto a version that resolves this vulnerability.Fixed in 2.2.3.1
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0391?
CVE-2012-0391 is classified as a critical vulnerability in Apache Struts.
How do I fix CVE-2012-0391?
To fix CVE-2012-0391, update Apache Struts to version 2.2.3.1 or later.
What types of attacks does CVE-2012-0391 enable?
CVE-2012-0391 allows remote attackers to execute arbitrary Java code via crafted parameters.
Which versions of Apache Struts are affected by CVE-2012-0391?
Apache Struts versions prior to 2.2.3.1 are affected by CVE-2012-0391.
What component of Apache Struts is vulnerable in CVE-2012-0391?
The vulnerable component in CVE-2012-0391 is the ExceptionDelegator component.