CVE-2012-0391

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2012-0391
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.3 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html Broken Link Exploit
http://secunia.com/advisories/47393 Vendor Advisory
http://struts.apache.org/2.x/docs/s2-008.html Vendor Advisory
http://struts.apache.org/2.x/docs/version-notes-2311.html Vendor Advisory
http://www.exploit-db.com/exploits/18329 Exploit
https://issues.apache.org/jira/browse/WW-3668 Vendor Advisory
https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt Broken Link Exploit
http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html Broken Link Exploit
http://secunia.com/advisories/47393 Vendor Advisory
http://struts.apache.org/2.x/docs/s2-008.html Vendor Advisory
http://struts.apache.org/2.x/docs/version-notes-2311.html Vendor Advisory
http://www.exploit-db.com/exploits/18329 Exploit
https://issues.apache.org/jira/browse/WW-3668 Vendor Advisory
https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt Broken Link Exploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0391
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*
History

22 Oct 2025, 01:15

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0391 -

21 Oct 2025, 20:15

Type Values Removed Values Added
References
  • {'url': 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0391', 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}

21 Oct 2025, 19:16

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0391 -
References () http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html - Exploit, Broken Link () http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html - Broken Link, Exploit
References () https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt - Exploit, Broken Link () https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt - Broken Link, Exploit

12 Mar 2025, 20:03

Type Values Removed Values Added
References () http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html - Exploit () http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html - Exploit, Broken Link
References () https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt - Exploit () https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt - Exploit, Broken Link

10 Feb 2025, 21:15

Type Values Removed Values Added
CWE CWE-94
CVSS v2 : 9.3
v3 : unknown 		v2 : 9.3
v3 : 9.8

21 Nov 2024, 01:34

Type Values Removed Values Added
References () http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html - Exploit () http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html - Exploit
References () http://secunia.com/advisories/47393 - Vendor Advisory () http://secunia.com/advisories/47393 - Vendor Advisory
References () http://struts.apache.org/2.x/docs/s2-008.html - Vendor Advisory () http://struts.apache.org/2.x/docs/s2-008.html - Vendor Advisory
References () http://struts.apache.org/2.x/docs/version-notes-2311.html - Vendor Advisory () http://struts.apache.org/2.x/docs/version-notes-2311.html - Vendor Advisory
References () http://www.exploit-db.com/exploits/18329 - Exploit () http://www.exploit-db.com/exploits/18329 - Exploit
References () https://issues.apache.org/jira/browse/WW-3668 - Vendor Advisory () https://issues.apache.org/jira/browse/WW-3668 - Vendor Advisory
References () https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt - Exploit () https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt - Exploit
Information

Published : 2012-01-08 15:55

Updated : 2025-10-22 01:15

NVD link : CVE-2012-0391

Mitre link : CVE-2012-0391

CVE.ORG link : CVE-2012-0391

JSON object : View

Products Affected

apache

  • struts
CWE
CWE-20

Improper Input Validation

CWE-94

Improper Control of Generation of Code ('Code Injection')