GHSA-4wrr-9h5r-m92w

Apache Struts Remote Java Code Execution

At a glance

Published: 2022-05-04 00:29 UTC
Updated: 2026-05-05 15:58 UTC
CVE: CVE-2012-0391
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The `ExceptionDelegator` component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.

Affected packages

Package	Versions
Maven · org.apache.struts:struts2-core	introduced 0, fixed 2.2.3.1
Maven · org.apache.struts.xwork:xwork-core	introduced 0, fixed 2.2.3.1

References

https://nvd.nist.gov/vuln/detail/CVE-2012-0391 ADVISORY
https://github.com/apache/struts/commit/25e50069d60434a30395e3a98357ffba2bed427e WEB
https://github.com/apache/struts/commit/5f54b8d087f5125d96838aafa5f64c2190e6885b WEB
https://github.com/apache/struts/commit/b4265d369dc29d57a9f2846a85b26598e83f3892 WEB
https://github.com/apache/struts PACKAGE
https://issues.apache.org/jira/browse/WW-3668 WEB
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0391 WEB
https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt WEB
http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html WEB
http://secunia.com/advisories/47393 WEB
http://struts.apache.org/2.x/docs/s2-008.html WEB
http://struts.apache.org/2.x/docs/version-notes-2311.html WEB
http://www.exploit-db.com/exploits/18329 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database