CVE-2012-0838
Apache Struts Code injection due to conversion error
Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.
Exploit likelihood
What each source reports
NVD Score used
Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.
- Record
CVE-2012-0838- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.
- Record
CVE-2012-0838- Updated
- 2026-11-02
EUVDEUVD-2022-4641 No score
Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.
- Record
EUVD-2022-4641- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mwrx-hx6x-3hhv No score
Apache Struts Code injection due to conversion error
Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.
- Record
GHSA-mwrx-hx6x-3hhv- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-mwrx-hx6x-3hhv No score
Apache Struts Code injection due to conversion error
Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.
- Record
GHSA-mwrx-hx6x-3hhv- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts:struts2-coreMaven |
before 2.2.3.1 | 2.2.3.1 |
org.apache.struts.xwork:xwork-coreMaven |
before 2.2.3.1 | 2.2.3.1 |
org.apache.struts:struts2-coreMaven |
before 2.2.3.1, plus listed versions 2.0.112.0.11.12.0.11.22.0.122.0.14 Show 11 moreShow less2.0.52.0.62.0.82.0.92.1.22.1.62.1.82.1.8.12.2.12.2.1.12.2.3 |
2.2.3.1 |
org.apache.struts.xwork:xwork-coreMaven |
before 2.2.3.1, plus listed versions 2.2.12.2.1.12.2.3 |
2.2.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-0838 is a high vulnerability (CVSS 10.0) in Apache Struts, published March 2, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 13.7%, the 96th percentile. Fixed in org.apache.struts:struts2-core 2.2.3.1.