CVE-2012-0838: Input Validation
Published Mar 2, 2012
·Updated
Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.
Affected Software
3 affected componentsFixes available
maven/org.apache.struts.xwork:xwork-core<2.2.3.1
2.2.3.1
maven/org.apache.struts:struts2-core<2.2.3.1
2.2.3.1
Apache struts>=2.0.0<=2.2.3
Event History
Mar 2, 2012
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
May 14, 2022
Advisory Published
01:51 AM
Frequently Asked Questions
1
What is the severity of CVE-2012-0838?
CVE-2012-0838 has a high severity rating due to the potential for remote code execution.
2
How do I fix CVE-2012-0838?
The vulnerability can be mitigated by upgrading Apache Struts to version 2.2.3.1 or later.
3
What systems are affected by CVE-2012-0838?
CVE-2012-0838 affects all versions of Apache Struts from 2.0.0 up to 2.2.3.
4
What type of attack does CVE-2012-0838 facilitate?
CVE-2012-0838 allows attackers to execute arbitrary code by exploiting OGNL expression evaluation during conversion errors.
5
Are there any known exploits for CVE-2012-0838?
Yes, there are known exploits that leverage the vulnerability to execute malicious code remotely.