EDB-18329
functionalApache Struts 2 < 2.3.1 - Multiple Vulnerabilities
view exploit source exploit_dbverifiedtype webappsauthor SEC Consultpublished 2012-01-06catalog exploit_db
01
exploited CVEs (4)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2012-0394US | medium6.8 | Exploit | ||
The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOT… | ||||
| CVE-2012-0393US | medium6.4 | Exploit | ||
The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary fi… | ||||
| CVE-2012-0392US | medium6.8 | Exploit | ||
The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted… | ||||
| CVE-2012-0391US | critical9.8OT critical | KEV | ||
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of prop… | ||||
scry
Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.
Free scan