Apache Struts Remote Java Code Execution
The `ExceptionDelegator` component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2012-0391US | critical9.8OT kritisch | KEV | ||
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of prop… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.htmlWEB
- http://secunia.com/advisories/47393WEB
- http://struts.apache.org/2.x/docs/s2-008.htmlWEB
- http://struts.apache.org/2.x/docs/version-notes-2311.htmlWEB
- http://www.exploit-db.com/exploits/18329WEB
- https://github.com/apache/strutsPACKAGE
- https://github.com/apache/struts/commit/25e50069d60434a30395e3a98357ffba2bed427eWEB
- https://github.com/apache/struts/commit/5f54b8d087f5125d96838aafa5f64c2190e6885bWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan