Apache Struts Remote Java Code Execution
The `ExceptionDelegator` component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2012-0391US | critical9.8OT critical | KEV | ||
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of prop… | ||||
02
references
External citations — patches, advisories, analysis.
- http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.htmlWEB
- http://secunia.com/advisories/47393WEB
- http://struts.apache.org/2.x/docs/s2-008.htmlWEB
- http://struts.apache.org/2.x/docs/version-notes-2311.htmlWEB
- http://www.exploit-db.com/exploits/18329WEB
- https://github.com/apache/strutsPACKAGE
- https://github.com/apache/struts/commit/25e50069d60434a30395e3a98357ffba2bed427eWEB
- https://github.com/apache/struts/commit/5f54b8d087f5125d96838aafa5f64c2190e6885bWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan