NVD

Id
42500  
Name
CVE-2012-0391  
Description
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.  
Reject
 
CVSS Version
2  
CVSS Score
9.3  
Severity
High  
CVSS Base Score
9.3  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2012-01-08  
Modified Date
2012-01-10  
Seq
2012-0391  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
214123 42500 CVE-2012-0391 20120105 SEC Consult SA-20120104-0 :: Multiple critical vulnerabilities in Apache Struts2  View
214124 42500 CVE-2012-0391 http://struts.apache.org/2.x/docs/s2-008.html  View
214125 42500 CVE-2012-0391 http://struts.apache.org/2.x/docs/version-notes-2311.html  View
214126 42500 CVE-2012-0391 18329  View
214127 42500 CVE-2012-0391 https://issues.apache.org/jira/browse/WW-3668  View
214128 42500 CVE-2012-0391 https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
25326 JVNDB-2012-001033 Apache Struts における任意の Java コードを実行される脆弱性 Apache Struts の ExceptionDelegator コンポーネントは、プロパティの異なるデータ型の例外処理の間、パラメータ値を OGNL 式として解釈するため、任意の Java コードを実行される脆弱性が存在します。 CVE-2012-0391 53629 CVE-2012-0391 42500 9.3 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-001033.html 2012-01-08 2012-01-11 View