CVE-2011-3923

Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.

Score

CVSS 3.1 9.8 Critical

Status

Modified - chrome-cve-admin@google.com

Published

2019-11-01

Last modified

2024-08-06

Weaknesses

CWE-732

Affected products

• Struts (Apache)
• Jboss Enterprise Web Server (Redhat)

References

• http://seclists.org/fulldisclosure/2014/Jul/38
• http://www.exploit-db.com/exploits/24874
• http://www.securityfocus.com/bid/51628
• http://www.securitytracker.com/id?1026575
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3923
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72585
• https://security-tracker.debian.org/tracker/CVE-2011-3923