CVE-2012-0391
Published 2012-01-08 · Updated 2026-06-16 · Source cve@mitre.org
Summary
CVE-2012-0391 is a critical-severity (CVSS 9.8) vulnerability in Apache Struts 2. CISA added it to the Known Exploited Vulnerabilities catalog on January 21, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by July 21, 2022. CISA does not currently list it as used in ransomware campaigns. Apache has 41 vulnerabilities in the KEV catalog, 8 of them linked to ransomware.
All 41 known-exploited Apache vulnerabilities →Description
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Apache — Struts 2
Name: Apache Struts 2 Improper Input Validation Vulnerability
Date added: 2022-01-21 · Due: 2022-07-21
Required action: Apply updates per vendor instructions.
References
- http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html
- http://secunia.com/advisories/47393
- http://struts.apache.org/2.x/docs/s2-008.html
- http://struts.apache.org/2.x/docs/version-notes-2311.html
- http://www.exploit-db.com/exploits/18329
- https://issues.apache.org/jira/browse/WW-3668
- https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt
- http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html