CVE-2012-0392: Medium severity apache struts 2 vulnerability
Published Jan 8, 2012
·Updated
The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.
Affected Software
3 affected componentsFixes available
maven/org.apache.struts.xwork:xwork-core<2.2.3.1
2.2.3.1
maven/org.apache.struts:struts2-core<2.2.3.1
2.2.3.1
Apache struts>=2.0.0<2.3.1
Event History
Jan 8, 2012
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
May 4, 2022
Advisory Published
12:29 AM
Frequently Asked Questions
1
What is the severity of CVE-2012-0392?
CVE-2012-0392 has a high severity rating due to its potential to allow remote command execution.
2
How do I fix CVE-2012-0392?
To address CVE-2012-0392, upgrade Apache Struts to version 2.3.1.1 or later.
3
What components are affected by CVE-2012-0392?
CVE-2012-0392 affects the CookieInterceptor component in Apache Struts versions before 2.3.1.1.
4
What type of attack is possible with CVE-2012-0392?
CVE-2012-0392 allows remote attackers to execute arbitrary commands through a crafted HTTP Cookie header.
5
Is there a workaround for CVE-2012-0392 if immediate patching is not possible?
There is no known workaround for CVE-2012-0392, so upgrading to a fixed version is recommended.