CVE-2012-0394: Code Injection
DISPUTED The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0394?
CVE-2012-0394's severity is disputed, as the vendor does not classify it as a security vulnerability.
How do I fix CVE-2012-0394?
To mitigate CVE-2012-0394, upgrade to Apache Struts version 2.3.18 or later.
What versions of Apache Struts are affected by CVE-2012-0394?
CVE-2012-0394 affects Apache Struts versions from 2.0.0 to 2.3.17 when in developer mode.
Can CVE-2012-0394 be exploited remotely?
Yes, CVE-2012-0394 allows remote attackers to execute arbitrary commands when certain conditions are met.
Is CVE-2012-0394 a common vulnerability?
CVE-2012-0394 is specific to Apache Struts and reflects issues encountered in earlier versions before 2.3.18.