Every CVE Search/ Get API key

CVE-2012-0394

Apache Struts's DebuggingInterceptor component allows remote code execution in developer mode

6.8 MediumPublic exploitFix availableDisputed

The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself.

Exploit likelihood

72.9%Down 8.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.8

The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself.

Record
CVE-2012-0394
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-94
Updated
2026-11-02
CVE List No score

The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself.

Record
CVE-2012-0394
Updated
2026-11-02
EUVDEUVD-2022-4179 No score

The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself.

Record
EUVD-2022-4179
Updated
2026-11-03
GitHub AdvisoriesGHSA-hmvj-gc9q-mg9p No score

Apache Struts's DebuggingInterceptor component allows remote code execution in developer mode

The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."

Record
GHSA-hmvj-gc9q-mg9p
Weakness
CWE-94
Updated
2026-11-02
OSVGHSA-hmvj-gc9q-mg9p No score

Apache Struts's DebuggingInterceptor component allows remote code execution in developer mode

The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."

Record
GHSA-hmvj-gc9q-mg9p
Weakness
CWE-94
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.struts.xwork:xwork-core
Maven
 before 2.3.18
2.3.18
org.apache.struts.xwork:xwork-core
Maven
 before 2.3.18, plus listed versions
2.2.12.2.1.12.2.32.2.3.12.3.1
Show 20 moreShow less
2.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.15.22.3.15.32.3.162.3.16.12.3.16.22.3.16.32.3.32.3.42.3.4.12.3.72.3.8
2.3.18

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBApache Struts 2 < 2.3.1 - Multiple Vulnerabilities2012-01-06
Exploit-DBApache Struts - Developer Mode OGNL Execution (Metasploit)2014-02-05
MetasploitApache Struts 2 Developer Mode OGNL Execution2012-01-06
NucleiApache Struts <2.3.1.1 - Remote Code Execution

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-0394 is a medium vulnerability (CVSS 6.8) in Apache Struts, published January 8, 2012. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 72.9%, the 99th percentile. Fixed in org.apache.struts.xwork:xwork-core 2.3.18.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open