CVE-2012-4387
Denial of service in Apache Struts
CVE-2012-4387 is a medium vulnerability (CVSS 5.0) in Apache Struts, published September 5, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.14%, the 94th percentile. Fixed in org.apache.struts.xwork:xwork-core 2.3.4.1.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 8.14%EPSS, 94th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.3.4.1org.apache.struts.xwork:xwork-core +1 more
Description
Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts.xwork:xwork-coreMaven | 2.0.0 up to 2.3.4.1 | 2.3.4.1 |
org.apache.struts.xwork:xwork-coreMaven | 2.0.0 up to 2.3.4.1, plus listed versions 2.2.12.2.1.12.2.32.2.3.12.3.1 Show 4 moreShow less2.3.1.12.3.1.22.3.32.3.4 | 2.3.4.1 |
What each source reports
NVD Score used
Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
- Record
CVE-2012-4387- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
- Record
CVE-2012-4387- Updated
- 2026-11-02
EUVDEUVD-2022-4209No score
Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
- Record
EUVD-2022-4209- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hrgc-54mv-58gvNo score
Denial of service in Apache Struts
Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
- Record
GHSA-hrgc-54mv-58gv- Updated
- 2026-11-02
OSVGHSA-hrgc-54mv-58gvNo score
Denial of service in Apache Struts
Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
- Record
GHSA-hrgc-54mv-58gv- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.