CVE-2012-0391

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - cve@mitre.org

Published

2012-01-08

Last modified

2025-10-22

Known exploited (CISA KEV)

since 2022-01-21, action due 2022-07-21: Apply updates per vendor instructions.

Weaknesses

CWE-94

Affected products

• Struts (Apache)

References

• http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html
• http://secunia.com/advisories/47393
• http://struts.apache.org/2.x/docs/s2-008.html
• http://struts.apache.org/2.x/docs/version-notes-2311.html
• http://www.exploit-db.com/exploits/18329
• https://issues.apache.org/jira/browse/WW-3668
• https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0391