CVE-2012-0392: Medium severity Apache struts vulnerability
The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.struts.xwork:xwork-coreto a version that resolves this vulnerability.Fixed in 2.2.3.1 - Upgrade
Upgrade
maven/org.apache.struts:struts2-coreto a version that resolves this vulnerability.Fixed in 2.2.3.1
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0392?
CVE-2012-0392 has a high severity rating due to its potential to allow remote command execution.
How do I fix CVE-2012-0392?
To address CVE-2012-0392, upgrade Apache Struts to version 2.3.1.1 or later.
What components are affected by CVE-2012-0392?
CVE-2012-0392 affects the CookieInterceptor component in Apache Struts versions before 2.3.1.1.
What type of attack is possible with CVE-2012-0392?
CVE-2012-0392 allows remote attackers to execute arbitrary commands through a crafted HTTP Cookie header.
Is there a workaround for CVE-2012-0392 if immediate patching is not possible?
There is no known workaround for CVE-2012-0392, so upgrading to a fixed version is recommended.