CVE-2012-0393
Apache Struts's ParameterInterceptor component does not prevent access to public constructors
The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.
Exploit likelihood
What each source reports
NVD Score used
The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.
- Record
CVE-2012-0393- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.
- Record
CVE-2012-0393- Updated
- 2026-11-02
EUVDEUVD-2022-4247 No score
The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.
- Record
EUVD-2022-4247- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hxqq-w4mr-mc62 No score
Apache Struts's ParameterInterceptor component does not prevent access to public constructors
The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.
- Record
GHSA-hxqq-w4mr-mc62- Updated
- 2026-11-02
OSVGHSA-hxqq-w4mr-mc62 No score
Apache Struts's ParameterInterceptor component does not prevent access to public constructors
The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.
- Record
GHSA-hxqq-w4mr-mc62- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts.xwork:xwork-coreMaven |
before 2.2.3.1 | 2.2.3.1 |
org.apache.struts:struts2-coreMaven |
before 2.3.1.1 | 2.3.1.1 |
org.apache.struts:struts2-coreMaven |
before 2.3.1.1, plus listed versions 2.0.112.0.11.12.0.11.22.0.122.0.14 Show 13 moreShow less2.0.52.0.62.0.82.0.92.1.22.1.62.1.82.1.8.12.2.12.2.1.12.2.32.2.3.12.3.1 |
2.3.1.1 |
org.apache.struts.xwork:xwork-coreMaven |
before 2.2.3.1, plus listed versions 2.2.12.2.1.12.2.3 |
2.2.3.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Struts 2 < 2.3.1 - Multiple Vulnerabilities | 2012-01-06 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-0393 is a medium vulnerability (CVSS 6.4) in Apache Struts, published January 8, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 36.3%, the 98th percentile. Fixed in org.apache.struts.xwork:xwork-core 2.2.3.1.
References
exploit-db.com/exploits/18329
archives.neohapsis.com/archives/bugtraq/2012-01/0031.html
struts.apache.org/2.x/docs/version-notes-2311.html
sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt
secunia.com/advisories/47393
Show 7 moreShow less
nvd.nist.gov/vuln/detail/CVE-2012-0393
github.com/apache/struts/commit/25e50069d60434a30395e3a98357ffba2bed427e
web.archive.org/web/20120612142634/https://sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt