CVE-2012-4386: CSRF
Published Sep 5, 2012
·Updated
The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute.
Affected Software
36 affected componentsFixes available
maven/org.apache.struts:struts2-core>=2.0.0<2.3.4.1
2.3.4.1
Apache struts=2.0.0
Apache struts=2.0.1
Apache struts=2.0.2
Apache struts=2.0.3
Apache struts=2.0.4
Apache struts=2.0.5
Apache struts=2.0.6
Apache struts=2.0.7
Apache struts=2.0.8
Apache struts=2.0.9
Apache struts=2.0.10
Apache struts=2.0.11
Apache struts=2.0.11.1
Apache struts=2.0.11.2
Apache struts=2.0.12
Apache struts=2.0.13
Apache struts=2.0.14
Apache struts=2.1.0
Apache struts=2.1.1
Apache struts=2.1.2
Apache struts=2.1.3
Apache struts=2.1.4
Apache struts=2.1.5
Apache struts=2.1.6
Apache struts=2.1.8
Apache struts=2.1.8.1
Apache struts=2.2.1
Apache struts=2.2.1.1
Apache struts=2.2.3
Apache struts=2.2.3.1
Apache struts=2.3.1
Apache struts=2.3.1.1
Apache struts=2.3.1.2
Apache struts=2.3.3
Apache struts=2.3.4
Event History
Sep 5, 2012
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
May 17, 2022
Advisory Published
01:42 AM
Frequently Asked Questions
1
What is the severity of CVE-2012-4386?
CVE-2012-4386 has a medium severity rating due to its potential for enabling cross-site request forgery (CSRF) attacks.
2
How do I fix CVE-2012-4386?
To fix CVE-2012-4386, you should upgrade to Apache Struts version 2.3.4.1 or later.
3
Which versions of Apache Struts are affected by CVE-2012-4386?
CVE-2012-4386 affects Apache Struts versions 2.0.0 through 2.3.4.
4
What types of attacks can CVE-2012-4386 allow?
CVE-2012-4386 can allow remote attackers to perform cross-site request forgery (CSRF) attacks.
5
Is there a patch available for CVE-2012-4386?
Yes, a patch is available in the form of an upgrade to Apache Struts version 2.3.4.1 or later.