{"id":"CVE-2012-0391","aliases":["EUVD-2022-2464","GHSA-4wrr-9h5r-m92w"],"status":"published","title":"Apache Struts Remote Java Code Execution","description":"The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-06","score":0.75599,"percentile":0.99522,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-20","CWE-94"],"published":"2012-01-08T15:00:00Z","modified":"2026-06-16T23:37:12Z","kev":{"date_added":"2022-01-21","due_date":"2022-07-21","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-01-21"},{"source":"kev","since":"2022-01-21"}],"exploits":[{"source":"exploitdb","id":"EDB-18329","title":"Apache Struts 2 \u003c 2.3.1 - Multiple Vulnerabilities","type":"webapps","platform":"multiple","date":"2012-01-06","verified":true,"url":"https://www.exploit-db.com/exploits/18329"},{"source":"metasploit","id":"exploit/multi/http/struts_code_exec_exception_delegator","title":"Apache Struts Remote Command Execution","type":"exploit","platform":"Java,Linux,Windows","date":"2012-01-06","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/struts_code_exec_exception_delegator"},{"source":"exploitdb","id":"EDB-18984","title":"Apache Struts 2.2.1.1 - Remote Command Execution (Metasploit)","type":"remote","platform":"multiple","date":"2012-06-05","verified":true,"url":"https://www.exploit-db.com/exploits/18984"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.struts:struts2-core","fixed_in":["2.2.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.struts.xwork:xwork-core","fixed_in":["2.2.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.struts:struts2-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.struts.xwork:xwork-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.struts:struts2-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3.1"}]}],"versions":["2.0.11","2.0.11.1","2.0.11.2","2.0.12","2.0.14","2.0.5","2.0.6","2.0.8","2.0.9","2.1.2","2.1.6","2.1.8","2.1.8.1","2.2.1","2.2.1.1","2.2.3"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.struts.xwork:xwork-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3.1"}]}],"versions":["2.2.1","2.2.1.1","2.2.3"]}],"products":[{"vendor":"apache","product":"struts"},{"vendor":"apache","product":"struts 2"}],"references":[{"url":"http://www.exploit-db.com/exploits/18329","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","web"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Broken Link","Exploit","web"]},{"url":"http://struts.apache.org/2.x/docs/version-notes-2311.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://struts.apache.org/2.x/docs/s2-008.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt","tags":["x_refsource_MISC","x_transferred","Broken Link","Exploit","web"]},{"url":"https://issues.apache.org/jira/browse/WW-3668","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://secunia.com/advisories/47393","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0391","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-0391","tags":["advisory"]},{"url":"https://github.com/apache/struts/commit/25e50069d60434a30395e3a98357ffba2bed427e","tags":["web"]},{"url":"https://github.com/apache/struts/commit/5f54b8d087f5125d96838aafa5f64c2190e6885b","tags":["web"]},{"url":"https://github.com/apache/struts/commit/b4265d369dc29d57a9f2846a85b26598e83f3892","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4wrr-9h5r-m92w"},{"url":"https://github.com/apache/struts","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2012-0391","description":"The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.","status":"published","published":"2012-01-08T15:00:00Z","modified":"2025-10-22T00:05:48.504Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:52.638543Z"}],"euvd":[{"id":"EUVD-2022-2464","description":"The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.","status":"published","published":"2012-01-08T15:00:00Z","modified":"2025-10-22T00:05:48Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-01-21","updated_at":"2026-11-02T19:49:39.244432Z"}],"ghsa":[{"id":"GHSA-4wrr-9h5r-m92w","title":"Apache Struts Remote Java Code Execution","description":"The `ExceptionDelegator` component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.","status":"published","published":"2022-05-04T00:29:43Z","modified":"2026-04-24T21:11:45Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-94"],"updated_at":"2026-11-02T14:39:58.897998Z"}],"kev":[{"id":"CVE-2012-0391","title":"Apache Struts 2 Improper Input Validation Vulnerability","description":"The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.","cwes":["CWE-20"],"kev":{"date_added":"2022-01-21","due_date":"2022-07-21","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2012-0391","description":"The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.","status":"published","published":"2012-01-08T15:55:01.217Z","modified":"2026-06-16T23:37:12.15Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:02:13.468343Z"}],"osv":[{"id":"GHSA-4wrr-9h5r-m92w","title":"Apache Struts Remote Java Code Execution","description":"The `ExceptionDelegator` component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.","status":"published","published":"2022-05-04T00:29:43Z","modified":"2026-05-05T15:58:35.421759Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-94"],"updated_at":"2026-11-02T15:46:37.528068Z"}]}}