CVE-2012-4386

Cross-Site Request Forgery in Apache Struts

6.8 MediumFix available

The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute.

Exploit likelihood

3.36%Down 2.5 points since Feb 4, 2022

What each source reports

NVD Score used 6.8

Record: CVE-2012-4386
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-352
Updated: 2026-11-02

CVE List No score

Record: CVE-2012-4386
Updated: 2026-11-02

EUVDEUVD-2022-2048 No score

Record: EUVD-2022-2048
Updated: 2026-11-03

GitHub AdvisoriesGHSA-2rvh-q539-q33v No score

Cross-Site Request Forgery in Apache Struts

Record: GHSA-2rvh-q539-q33v
Weakness: CWE-352
Updated: 2026-11-02

OSVGHSA-2rvh-q539-q33v No score

Cross-Site Request Forgery in Apache Struts

Record: GHSA-2rvh-q539-q33v
Weakness: CWE-352
Updated: 2026-11-02

Affected products

apache struts

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.struts:struts2-core` Maven	2.0.0 up to 2.3.4.1	2.3.4.1
`org.apache.struts:struts2-core` Maven	2.0.0 up to 2.3.4.1, plus listed versions 2.0.112.0.11.12.0.11.22.0.122.0.14 Show 17 moreShow less 2.0.52.0.62.0.82.0.92.1.22.1.62.1.82.1.8.12.2.12.2.1.12.2.32.2.3.12.3.12.3.1.12.3.1.22.3.32.3.4	2.3.4.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-4386 is a medium vulnerability (CVSS 6.8) in Apache Struts, published September 5, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.36%, the 88th percentile. Fixed in org.apache.struts:struts2-core 2.3.4.1.