CVE-2012-0391
Critical · 9.8 CISA KEVCVSS
9.8
EPSS
75.6%
Published
Jan 8, 2012
CISA due date
Jul 21, 2022
The record
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.struts.xwork:xwork-core | 0 | 2.2.3.1 |
| Maven | org.apache.struts:struts2-core | 0 | 2.2.3.1 |
Related vulnerabilities
- GHSA-qcfc-hmrc-59x7 Apache Struts 2 is Missing XML Validation Also affects org.apache.struts.xwork:xwork-core
- CVE-2025-68493 Missing XML Validation vulnerability in Apache Struts, Apache Struts. Also affects org.apache.struts.xwork:xwork-core
- CVE-2014-0094 The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to… Also affects org.apache.struts.xwork:xwork-core
- CVE-2013-2135 Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code… Also affects org.apache.struts.xwork:xwork-core
- CVE-2013-2134 Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code… Also affects org.apache.struts.xwork:xwork-core
- CVE-2013-1966 Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code… Also affects org.apache.struts.xwork:xwork-core
- CVE-2013-2115 Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code… Also affects org.apache.struts.xwork:xwork-core
- CVE-2012-0838 Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the… Also affects org.apache.struts.xwork:xwork-core